Hi!
I'm new to this kind of solutions and, therefore, I need help trying to configure what I want.
I intend to rollover an index after 30 days. From my understanding, the cold phase is counted after the rollover date. Therefore, 1 day after the rollover, I want my rolled index to move into the cold phase.
Finally, data must be deleted 30 days after the rollover date. I assume that the oldest index is removed (because the data age is calculated from the rollover). This is my current configuration:
{
"filebeat" : {
"version" : 25,
"modified_date" : "2022-02-23T12:57:51.335Z",
"policy" : {
"phases" : {
"cold" : {
"min_age" : "1d",
"actions" : {
"freeze" : { },
"set_priority" : {
"priority" : 0
}
}
},
"hot" : {
"min_age" : "0ms",
"actions" : {
"rollover" : {
"max_age" : "30d"
}
}
},
"delete" : {
"min_age" : "30d",
"actions" : {
"delete" : {
"delete_searchable_snapshot" : true
}
}
}
}
}
}
}
This figure tries to explain what i want to achieve:
