Index Lifecycle Maanagement / Policy - how does it work?

Elastic Stack Elasticsearch
1

Hi there,

I have been trying to get this to work but it seems it isnt applied properly but I cant figure out what the issue is:

What I want to achieve, as previously with Curator I would like to control the overall stored data in my stack by purging data out or preferably rollover when a certain index reaches a certain size.

As an example I got an index packetbeat-7.3.1-2019.09.07-000001 with the current size of 29.4GB though my policy says:
rollover, max size 5B, maximum age 1 - with the aim that if the size gets above 5GB to create a new index else on a daily basis
my deletion policy says 7 days from rollover

pretty simple I would say? expectation it created 5GB indexes or daily ones, and starts removing them after 7days, so I would have only 35GB occupied by packetbeat data - but though this policy is assigned it doesnt seem to have the expected outcomes.

when I check the policy itself - as I did just now, I can see that the policy assigned in kibana does not match:
GET packetbeat-*/_ilm/explain

{
  "indices" : {
    "packetbeat-7.3.1-2019.09.07-000001" : {
      "index" : "packetbeat-7.3.1-2019.09.07-000001",
      "managed" : true,
      "policy" : "packetbeat-7.3.1",
      "lifecycle_date_millis" : 1567848053342,
      "phase" : "hot",
      "phase_time_millis" : 1567848053490,
      "action" : "rollover",
      "action_time_millis" : 1567848421271,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1567848421271,
      "phase_execution" : {
        "policy" : "packetbeat-7.3.1",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "version" : 28,
        "modified_date_in_millis" : 1567848053149
      }

Kibana
Kibana.png1158×810 68.6 KB

what am I doing wrong here or why arent the kibana set values applied?

cheers

EDIT: seems you cant edit the policy in place, need to remove and re-attach to enforce it ....

2

Hello,

I have the same issue.

From this discussion, max_size = maximum size of each primary shards , so if I set max_size = 5mb in a 3 primary shard and one replica, index size should be 3x5 = 15mb. Currently, my index are all above this limit and I don't know why :

green  open   ims_logs-000002      klTujxujS6GmJyjYbkcCPg   3   1     226550            0       30mb         15.1mb
green  open   ims_logs-000003      le2lgAfFSgija9alsrpcXg   3   1     149400            0     20.3mb         10.2mb
green  open   ims_logs-000004      Z7vki7jAQsCg5HcSYkZ-IQ   3   1     698961            0     90.3mb           45mb
green  open   ims_logs-000005      vjcf3qzIQEiHIvq4O7LgRg   3   1          0            0       52mb         26.1mb

GET /ims_logs*/_ilm/explain :

 },
"ims_logs-000004" : {
  "index" : "ims_logs-000004",
  "managed" : true,
  "policy" : "ims_ilm_policy",
  "lifecycle_date_millis" : 1568708711122,
  "phase" : "hot",
  "phase_time_millis" : 1568705483043,
  "action" : "complete",
  "action_time_millis" : 1568708711470,
  "step" : "complete",
  "step_time_millis" : 1568708711470,
  "phase_execution" : {
    "policy" : "ims_ilm_policy",
    "phase_definition" : {
      "min_age" : "0ms",
      "actions" : {
        "rollover" : {
          "max_size" : "5mb"
        }
      }
    },
    "version" : 1,
    "modified_date_in_millis" : 1568031917850
  }
},

@Christian_Dahlqvist any idea on how to debug this ? :sweat_smile:

3

How long did it take you to index that data volume? By default I think ILM only checks every 5 or 10 minutes which is fine for real use cases but can impact small tests like this.

4

It could be but I set Lifecycle poll interval to 1 sec

 "indices.lifecycle.poll_interval":"1s

So I don't think this is the issue

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.