Hi, I'm facing some problem in Index life cycle policy in which indexes are not roll overing and delete phase is not working. Is there is a best practice to do so?
It would help if you showed your policy as well as indices stats.
Applied Life Cycle Policy for metricbeat-7.6.2-000001. Life Cycle Policy contains Hot phase and Delete phase. Once size increased index pattern will rollover to metricbeat-7.6.2-000002 and it is not deleting the first index. So that the size is increasing in metricbeat-7.6.2-000001.
How are you sending data to the index? Are you writing to the write alias?
What does your Metricbeat config look like?
Here the metricbeat-7.6.2-000001 is the index pattern name.
That is not the write alias so is the reason it is not working.
Can you please help me out with the right one
Have a look at this guide to setting up an ILM policy. When you create the first index you specify a write index alias (test-alias in the example in the docs I linked to). This is what you configure Logstash and/or Metricbeat to write to, not the actual index name. This will allow the alias to move to a new index once rollover happens.
Thankyou
When I tried to give the aliases as per the documentation it showing some error(Invalid JSON format)....Please help me to rectify the error.
Here the data is pushing through the logstash by using index => "%{[@metadata][beat]}-%{[@metadata][version]}-000001". As it is passing through the logstash, rollovering is happening but it is not deleting the old index and it is keep on adding the size of the old index. Whether I need to change anything in this config. file.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.