Hello everyone,
I need your help please,
I created a new ILM policy but packetbeat is still using the default policy
here is my configuration
Creation of the new policy:
PUT _ilm/policy/hot-warm-cold-delete-60days-policy
{
"policy": {
"phases": {
"hot": {
"actions": {
"rollover": {
"max_size":"50gb",
"max_age":"30d"
},
"set_priority": {
"priority": 50
}
}
},
"warm": {
"min_age": "7d",
"actions": {
"forcemerge": {
"max_num_segments": 1
},
"shrink": {
"number_of_shards": 1
},
"allocate": {
"require": {
"data": "warm"
}
},
"set_priority": {
"priority": 25
}
}
},
"cold": {
"min_age": "30d",
"actions": {
"set_priority": {
"priority": 0
},
"freeze": {},
"allocate": {
"require": {
"data": "cold"
}
}
}
},
"delete": {
"min_age": "60d",
"actions": {
"delete": {}
}
}
}
}
}
**Creation of the new template **
PUT _template/hot-warm-cold-delete-60days-template
{
"index_patterns": ["packetbeat-*"],
"settings": {
"number_of_shards": 1,
"number_of_replicas": 1,
"index.lifecycle.name": "hot-warm-cold-delete-60days-policy",
"index.lifecycle.rollover_alias": "packetbeat"
}
}
**Boostrap index **
PUT packetbeat-000001
{
"aliases": {
"packetbeat": {
"is_write_index": true
}
}
}
check the ILM health
{
"indices" : {
"packetbeat-7.8.0-2020.07.15-000001" : {
"index" : "packetbeat-7.8.0-2020.07.15-000001",
"managed" : true,
"policy" : "packetbeat",
"lifecycle_date_millis" : 1594822825660,
"age" : "36.63m",
"phase" : "hot",
"phase_time_millis" : 1594822825737,
"action" : "rollover",
"action_time_millis" : 1594823388344,
"step" : "check-rollover-ready",
"step_time_millis" : 1594823388344,
"phase_execution" : {
"policy" : "packetbeat",
"phase_definition" : {
"min_age" : "0ms",
"actions" : {
"rollover" : {
"max_size" : "50gb",
"max_age" : "30d"
}
}
},
"version" : 1,
"modified_date_in_millis" : 1594822718394
}
},
"packetbeat-000001" : {
"index" : "packetbeat-000001",
"managed" : true,
"policy" : "hot-warm-cold-delete-60days-policy",
"lifecycle_date_millis" : 1594822682756,
"age" : "39.01m",
"phase" : "hot",
"phase_time_millis" : 1594822682803,
"action" : "rollover",
"action_time_millis" : 1594822788404,
"step" : "check-rollover-ready",
"step_time_millis" : 1594822788404,
"phase_execution" : {
"policy" : "hot-warm-cold-delete-60days-policy",
"phase_definition" : {
"min_age" : "0ms",
"actions" : {
"rollover" : {
"max_size" : "50gb",
"max_age" : "30d"
},
"set_priority" : {
"priority" : 50
}
}
},
"version" : 1,
"modified_date_in_millis" : 1594822612162
}
}
}
}
**In kibana I delete the default policy, but I always find it back and packetbeat still using it and not use my new policy **
packetbeat configuration
output.elasticsearch:
setup.ilm.enabled: true
setup.ilm.policy_name: "hot-warm-cold-delete-60days-policy"