ILM question

Hi!

I'm new to this kind of solutions and, therefore, I need help trying to configure what I want.

I intend to rollover an index after 30 days. From my understanding, the cold phase is counted after the rollover date. Therefore, 1 day after the rollover, I want my rolled index to move into the cold phase.

Finally, data must be deleted 30 days after the rollover date. I assume that the oldest index is removed (because the data age is calculated from the rollover). This is my current configuration:

{
  "filebeat" : {
    "version" : 25,
    "modified_date" : "2022-02-23T12:57:51.335Z",
    "policy" : {
      "phases" : {
        "cold" : {
          "min_age" : "1d",
          "actions" : {
            "freeze" : { },
            "set_priority" : {
              "priority" : 0
            }
          }
        },
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_age" : "30d"
            }
          }
        },
        "delete" : {
          "min_age" : "30d",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    }
  }
}

This figure tries to explain what i want to achieve:

What version of the Stack are you using here?

I am using version 7.13.4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.