Index Life cycle Policy indexes not roll overing

Elastic Stack Elasticsearch
1

Hi, I'm facing some problem in Index life cycle policy in which indexes are not roll overing and delete phase is not working. Is there is a best practice to do so?

2

It would help if you showed your policy as well as indices stats.

3

ELK_ind
ELK_ind1892×890 109 KB

Applied Life Cycle Policy for metricbeat-7.6.2-000001. Life Cycle Policy contains Hot phase and Delete phase. Once size increased index pattern will rollover to metricbeat-7.6.2-000002 and it is not deleting the first index. So that the size is increasing in metricbeat-7.6.2-000001.

4

How are you sending data to the index? Are you writing to the write alias?

5

Yes..

image
image1228×830 36.1 KB

6

What does your Metricbeat config look like?

7

Here the metricbeat-7.6.2-000001 is the index pattern name.

8

That is not the write alias so is the reason it is not working.

9

Can you please help me out with the right one

10

Have a look at this guide to setting up an ILM policy. When you create the first index you specify a write index alias (test-alias in the example in the docs I linked to). This is what you configure Logstash and/or Metricbeat to write to, not the actual index name. This will allow the alias to move to a new index once rollover happens.

11

Thankyou

12

image
image1071×777 27.3 KB

When I tried to give the aliases as per the documentation it showing some error(Invalid JSON format)....Please help me to rectify the error.

13

Capture1

Here the data is pushing through the logstash by using index => "%{[@metadata][beat]}-%{[@metadata][version]}-000001". As it is passing through the logstash, rollovering is happening but it is not deleting the old index and it is keep on adding the size of the old index. Whether I need to change anything in this config. file.