Index lifecycle create index every day

Elastic Stack Kibana
1

Hello,

Is there a way to create new index in index lifecycle manager every day without taking in count the size of the index or other factors?

Regards.
Peter

2

Hi Peter,

You can set a max_age to your rollover ILM policy.

From the documentation :

https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html

3

I have this set in the ILP and it doesn't seam to work:

Screenshot 2020-07-01 at 15.57.04
Screenshot 2020-07-01 at 15.57.042338×2788 525 KB

4

Have you try to change your ILM config via the Dev Tool ?

What result you have when you get your ILM policy from it too ?

The UI is great for common things but to me more precise, I perfer, personnaly, use the API.

5

When the policy will be executed?

6

Elasticearch will check the state of their policy every X seconds/minutes. If I remember well it something like every 15 minutes.

The rolling will be executed after all conditions are filled.

If you configured it correctly, normally every day.

7

this is what I get from the dev tools:

    {
      "metricbeat-7.5.0" : {
        "version" : 7720,
        "modified_date" : "2020-07-01T12:56:52.945Z",
        "policy" : {
          "phases" : {
            "hot" : {
              "min_age" : "0ms",
              "actions" : {
                "rollover" : {
                  "max_size" : "50gb",
                  "max_age" : "24h"
                }
              }
            }
          }
        }
      }
    }
8

You can try something like this config :

   PUT _ilm/policy/my_policy
   {
     "policy": {
       "phases": {
         "hot": {                      
           "actions": {
             "rollover": { 
               "max_age": "1d"
             }
           }
         }
       }
     }
   }

You can also inspire you from there :

https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-lifecycle-policy.html

9

I've run this ilm config:

PUT _ilm/policy/packetbeat-7.5.0
   {
     "policy": {
       "phases": {
         "hot": {                      
           "actions": {
             "rollover": { 
               "max_age": "12h"
             }
           }
         }
       }
     }
   }

When I look in the last index for packetbeat. I see the following:

  "indices" : {
    "packetbeat-7.5.0-2020.06.30-000007" : {
      "index" : "packetbeat-7.5.0-2020.06.30-000007",
      "managed" : true,
      "policy" : "packetbeat-7.5.0",
      "lifecycle_date_millis" : 1593546261570,
      "age" : "18.66h",
      "phase" : "hot",
      "phase_time_millis" : 1593546263292,
      "action" : "rollover",
      "action_time_millis" : 1593546861946,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1593546861946,
      "phase_execution" : {
        "policy" : "packetbeat-7.5.0",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "version" : 4,
        "modified_date_in_millis" : 1590153720816
      }
    }
  }
}

Does that mean that no matter what the polity was updated to the index will roll over only when it reaches 50G or 30days old, and only the newly created index will get the policies configured? If yes is there anyways we can modify the index ilm policy?

10

Ah yes, the updated policy will be taken in count for the newer indexes.

I founded a post which already explain how to do it :

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.