# ILM policy - why isn't it deleting?

**URL:** <https://discuss.elastic.co/t/ilm-policy-why-isnt-it-deleting/259483>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [December 23, 2020, 12:43pm UTC](https://discuss.elastic.co/t/ilm-policy-why-isnt-it-deleting/259483 "2020-12-23T12:43:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\
**Post date:** [December 23, 2020, 12:43pm UTC](https://discuss.elastic.co/t/ilm-policy-why-isnt-it-deleting/259483/1 "2020-12-23T12:43:34Z")

</div>

Indices are building up instead of being deleted. Here's the policy:

```
GET _ilm/policy/packetbeat
{
  "packetbeat" : {
    "version" : 6,
    "modified_date" : "2020-12-21T12:30:41.023Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "5gb",
              "max_age" : "3h"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "21h",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    }
  }
}

```

(Note that I didn't specify the 'delete\_searchable\_snapshot' param - that just showed up)

Looking at the matched indices I see that the majority are marked as 'delete phase' (which I would expect) but are still 'open' and 'green'. Why aren't they going away?

---

<div class="post-metadata">

**Author:** ![andreidan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andreidan/32/78167_2.png) [@andreidan](https://discuss.elastic.co/u/andreidan)\
**Post date:** [December 23, 2020, 1:51pm UTC](https://discuss.elastic.co/t/ilm-policy-why-isnt-it-deleting/259483/2 "2020-12-23T13:51:40Z")

</div>

Thanks for using Elasticsearch.

Can you post the output of the `_ilm/explain` [API](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-explain-lifecycle.html) for the managed indices you expected to have been deleted?

A few other things to double check:

- is ILM running ([https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-get-status.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-get-status.html)) ?
- ILM runns every configured `poll_interval`. What is the configured value for the [indices.lifecycle.poll\_interval](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-settings.html#_cluster_level_settings) setting?
- is this a [CCR](https://www.elastic.co/guide/en/elasticsearch/reference/current/ccr-getting-started.html) environment? If so the `delete` action would wait for the managed index to not be a leader before deleting

---

<div class="post-metadata">

**Author:** ![ethrbunny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethrbunny/32/34603_2.png) [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\
**Post date:** [December 28, 2020, 12:33pm UTC](https://discuss.elastic.co/t/ilm-policy-why-isnt-it-deleting/259483/3 "2020-12-28T12:33:32Z")

</div>

Here is the \_ilm/explain:

```
{
  "indices" : {
  "packetbeat-000060" : {
  "index" : "packetbeat-000060",
  "managed" : true,
  "policy" : "packetbeat",
  "lifecycle_date_millis" : 1608606522692,
  "age" : "6.39d",
  "phase" : "delete",
  "phase_time_millis" : 1608682123480,
  "action" : "complete",
  "action_time_millis" : 1608606524983,
  "step" : "complete",
  "step_time_millis" : 1608682123480,
  "phase_execution" : {
    "policy" : "packetbeat",
    "phase_definition" : {
      "min_age" : "21h",
      "actions" : { }
    },
    "version" : 5,
    "modified_date_in_millis" : 1608205781061
  }
}
  }
}

```

Im not sure how to go about finding the other pieces of information

---

<div class="post-metadata">

**Author:** ![andreidan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andreidan/32/78167_2.png) [@andreidan](https://discuss.elastic.co/u/andreidan)\
**Post date:** [January 4, 2021, 11:03am UTC](https://discuss.elastic.co/t/ilm-policy-why-isnt-it-deleting/259483/4 "2021-01-04T11:03:55Z")

</div>

It seems like the `delete` _phase_ does not define a delete _action_. We should prevent this from happening and we have an [issue](https://github.com/elastic/elasticsearch/issues/65847) to track this problem.  
This is visible under `phase_definition` in the `explain` output.

You can [update the policy definition](https://www.elastic.co/guide/en/elasticsearch/reference/current/update-lifecycle-policy.html) using the [PUT lifecycle API](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-put-lifecycle.html) and include a `delete` action.

eg.

```auto
    "policy": {
      "phases": {
   
        ...    

        "delete": {
          "min_age": "21h",
           "actions": {
             "delete": {}
           }
        }
     }
  }

```

This will make sure the future indices managed by the policy will get deleted. The existing ones (eg. `packetbeat-000060`) will have to manually be deleted as they are already in the `complete` step in the `delete` phase and won't be picked up for automatic deletion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 1, 2021, 11:03am UTC](https://discuss.elastic.co/t/ilm-policy-why-isnt-it-deleting/259483/5 "2021-02-01T11:03:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.