Index Lifecycle dilemma

Elastic Stack Elasticsearch
1

Hello,

Trying to get my head around how ILM works.
I have logstash creating these daily indices: and want to implement a simple ILM.

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "deposit-%{+YYYY.MM.dd}"
  }

ILM is like this:

{
    "policy": {
        "phases": {
            "hot": {
                "min_age": "0ms",
                "actions": {
                    "rollover": {
                        "max_age": "2d",
                        "max_size": "5gb"
                    },
                    "set_priority": {
                        "priority": 100
                    }
                }
            },
            "delete": {
                "min_age": "1d",
                "actions": {
                    "delete": {}
                }
            }
        }
    }
}

Problem is i'm getting this error:

illegal_argument_exception: index.lifecycle.rollover_alias [delete_deposit] does not point to index [deposit-2019.04.17]

This is the index template where the ILM applies:

  "deposit" : {
    "order" : 0,
    "index_patterns" : [
      "deposit*"
    ],
    "settings" : {
      "index" : {
        "lifecycle" : {
          "name" : "Delete",
          "rollover_alias" : "delete_deposit"
        },
        "number_of_shards" : "1"
      }
    },
    "mappings" : { },
    "aliases" : { }
  },

From what i understand an alias still needs to be created (delete_deposit). But where does this need to point to?? Is it the deposit* daily indices or towards the rollover index??

2

That's correct, usually the alias is created with the first alias, so someone does something like:

PUT /deposit-000001
{
  "aliases": {
    "delete_deposit":{
      "is_write_index": true
    }
  }
}

That would create the first "deposit" index and also create the "delete_deposit" alias pointing to this index.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.