It seems like the delete phase does not define a delete action. We should prevent this from happening and we have an issue to track this problem.
This is visible under phase_definition in the explain output.
You can update the policy definition using the PUT lifecycle API and include a delete action.
eg.
"policy": {
"phases": {
...
"delete": {
"min_age": "21h",
"actions": {
"delete": {}
}
}
}
}
This will make sure the future indices managed by the policy will get deleted. The existing ones (eg. packetbeat-000060) will have to manually be deleted as they are already in the complete step in the delete phase and won't be picked up for automatic deletion.