ILM Warm phase settings

Elastic Stack Elasticsearch
1

Hi guys,

I created an index lifecycle policy for warm phase, but I can not understand where new documents are?
My goal is: move old documents to read-only indexes.
Please see details below:

    PUT _ilm/policy/ro
    {
    "policy": {
        "phases": {
            "hot": {
                "min_age": "0ms",
                "actions": {
                    "rollover": {
                        "max_age": "1m",
                        "max_size": "50gb"
                    },
                    "set_priority": {
                        "priority": 50
                    }
                }
            },
            "warm": {
                "actions": {
                    "shrink": {
                        "number_of_shards": 1
                    },
                    "forcemerge": {
                        "max_num_segments": 1
                    },
                    "set_priority": {
                        "priority": 100
                    }
                }
            }
        }
    }
}

PUT _template/ro_t
{
    "index_patterns": [
        "log_events_store*"
    ],
    "settings": {
        "number_of_shards": 1,
        "number_of_replicas": 1,
        "index.lifecycle.name": "ro",
        "index.lifecycle.rollover_alias": "ro_a"
    }
}

    PUT log_events_store-000001
    {
        "aliases": {
            "ro_a": {
                "is_write_index": true
            }
        }
    }

Peridiocally I see new indexes like log_events_store-000001, log_events_store-000002 and so on, but each of them is empty (Docs count is 0). Generating of documents continue without any pause to index log_events_store.

Any ideas what I did wrong?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.