Hi Team,
I have the following ilm policy setup via logstash output filter.
output {
if [path] == "/media/sf_ELK/ATG01log.txt" {
elasticsearch {
hosts => ["localhost:9200"]
index => "atg"
ilm_rollover_alias => "atg"
ilm_pattern => "000001"
ilm_policy => "10G-Maintenance"
}
}
else if [path] == "/media/sf_ELK/ATG02log.txt" {
elasticsearch {
hosts => ["localhost:9200"]
index => "test"
ilm_rollover_alias => "test"
ilm_pattern => "000001"
ilm_policy => "10G-Maintenance"
}
}
}
The below is my ilm phase definition details
{
"policy": "10G-Maintenance",
"phase_definition": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_size": "10gb",
"max_age": "5d"
},
"set_priority": {
"priority": 100
}
}
},
"version": 6,
"modified_date_in_millis": 1565183203011
}
The above policy works for only one index (atg) configured in logstash output filter and not for the other index (test). Not sure what could be the reason for rollover not working on test index.