Index doesn't want to be stored in hot node

Elastic Stack Elasticsearch
1

Hi,

I have an elastic cluster with :

3 master nodes : roles [ data, master ]
1 hot node : roles [ data_hot ]
2 warm nodes : roles [ data_warm ]
3 cold nodes : roles [ data_cold ]

ELK Version : 7.10

I setted up an logstash placed in master 1 and the configuration is like this :

input {
  beats {
    port => 5044
   }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "winlogbeat-27-11-2020"
  }
}

And created an ILM policy on Kibana named : WINLOGBEAT-POLICY

{
  "WINLOGBEAT-POLICY" : {
    "version" : 3,
    "modified_date" : "2020-11-26T17:40:46.794Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "1gb",
              "max_age" : "12d"
            },
            "set_priority" : {
              "priority" : 200
            }
          }
        },
        "warm" : {
          "min_age" : "45d",
          "actions" : {
            "set_priority" : {
              "priority" : 50
            }
          }
        },
        "cold" : {
          "min_age" : "0d",
          "actions" : { }
        }
      }
    }
  }
}

Here is an _ilm/explain :

{
  "indices" : {
    "winlogbeat-27-11-2020" : {
      "index" : "winlogbeat-27-11-2020",
      "managed" : true,
      "policy" : "WINLOGBEAT-POLICY",
      "lifecycle_date_millis" : 1606435203091,
      "age" : "11.72h",
      "phase" : "hot",
      "phase_time_millis" : 1606477395075,
      "action" : "rollover",
      "action_time_millis" : 1606447395303,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1606477395075,
      "is_auto_retryable_error" : true,
      "failed_step_retry_count" : 25,
      "phase_execution" : {
        "policy" : "WINLOGBEAT-POLICY",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "1gb",
              "max_age" : "12d"
            },
            "set_priority" : {
              "priority" : 200
            }
          }
        },
        "version" : 3,
        "modified_date_in_millis" : 1606412446794
      }
    }
  }
}

The problem : The data is staying in the master nodes. I want the data to be stored in the hot node.

when I am doing a _nodes/stats, I can see that :

master 1 : 18,6 Gb
master 2 : 9,6 Gb
master 3 : 9,1 Gb
hot, warm 1, warm 2, cold 1, cold 2, cold 3 : 0 Gb

What did I do wrong ? Does the only "data" node role are considered has "data_hot" ? If this, why the hot node is at 0 byte ?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.