# Index Lifecycle Maanagement / Policy - how does it work?

**URL:** <https://discuss.elastic.co/t/index-lifecycle-maanagement-policy-how-does-it-work/199501>\
**Category:** Elasticsearch\
**Created:** [September 14, 2019, 11:47am UTC](https://discuss.elastic.co/t/index-lifecycle-maanagement-policy-how-does-it-work/199501 "2019-09-14T11:47:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![collse](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/collse/32/54197_2.png) [@collse](https://discuss.elastic.co/u/collse)\
**Post date:** [September 14, 2019, 11:47am UTC](https://discuss.elastic.co/t/index-lifecycle-maanagement-policy-how-does-it-work/199501/1 "2019-09-14T11:47:54Z")

</div>

Hi there,

I have been trying to get this to work but it seems it isnt applied properly but I cant figure out what the issue is:

What I want to achieve, as previously with Curator I would like to control the overall stored data in my stack by purging data out or preferably rollover when a certain index reaches a certain size.

As an example I got an index packetbeat-7.3.1-2019.09.07-000001 with the current size of 29.4GB though my policy says:  
rollover, max size 5B, maximum age 1 - with the aim that if the size gets above 5GB to create a new index else on a daily basis  
my deletion policy says 7 days from rollover

pretty simple I would say? expectation it created 5GB indexes or daily ones, and starts removing them after 7days, so I would have only 35GB occupied by packetbeat data - but though this policy is assigned it doesnt seem to have the expected outcomes.

when I check the policy itself - as I did just now, I can see that the policy assigned in kibana does not match:  
GET packetbeat-\*/\_ilm/explain

```
{
  "indices" : {
    "packetbeat-7.3.1-2019.09.07-000001" : {
      "index" : "packetbeat-7.3.1-2019.09.07-000001",
      "managed" : true,
      "policy" : "packetbeat-7.3.1",
      "lifecycle_date_millis" : 1567848053342,
      "phase" : "hot",
      "phase_time_millis" : 1567848053490,
      "action" : "rollover",
      "action_time_millis" : 1567848421271,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1567848421271,
      "phase_execution" : {
        "policy" : "packetbeat-7.3.1",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "version" : 28,
        "modified_date_in_millis" : 1567848053149
      }

```

 ![Kibana](https://us1.discourse-cdn.com/elastic/original/3X/c/3/c30d3064c7fbf8ceff8072a1b94774fafc3ac459.png)  
what am I doing wrong here or why arent the kibana set values applied?

cheers

EDIT: seems you cant edit the policy in place, need to remove and re-attach to enforce it ....

---

<div class="post-metadata">

**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\
**Post date:** [September 17, 2019, 3:53pm UTC](https://discuss.elastic.co/t/index-lifecycle-maanagement-policy-how-does-it-work/199501/2 "2019-09-17T15:53:49Z")

</div>

Hello,

I have the same issue.

From [this](https://github.com/elastic/elasticsearch/issues/37981) discussion, max\_size = maximum size of each primary shards , so if I set max\_size = 5mb in a 3 primary shard and one replica, index size should be 3x5 = 15mb. Currently, my index are all above this limit and I don't know why :

```
green open ims_logs-000002 klTujxujS6GmJyjYbkcCPg 3 1 226550 0 30mb 15.1mb
green open ims_logs-000003 le2lgAfFSgija9alsrpcXg 3 1 149400 0 20.3mb 10.2mb
green open ims_logs-000004 Z7vki7jAQsCg5HcSYkZ-IQ 3 1 698961 0 90.3mb 45mb
green open ims_logs-000005 vjcf3qzIQEiHIvq4O7LgRg 3 1 0 0 52mb 26.1mb

```

GET /ims\_logs\*/\_ilm/explain :

```
 },
"ims_logs-000004" : {
  "index" : "ims_logs-000004",
  "managed" : true,
  "policy" : "ims_ilm_policy",
  "lifecycle_date_millis" : 1568708711122,
  "phase" : "hot",
  "phase_time_millis" : 1568705483043,
  "action" : "complete",
  "action_time_millis" : 1568708711470,
  "step" : "complete",
  "step_time_millis" : 1568708711470,
  "phase_execution" : {
    "policy" : "ims_ilm_policy",
    "phase_definition" : {
      "min_age" : "0ms",
      "actions" : {
        "rollover" : {
          "max_size" : "5mb"
        }
      }
    },
    "version" : 1,
    "modified_date_in_millis" : 1568031917850
  }
},

```

@Christian_Dahlqvist any idea on how to debug this ? 😅

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 17, 2019, 4:29pm UTC](https://discuss.elastic.co/t/index-lifecycle-maanagement-policy-how-does-it-work/199501/3 "2019-09-17T16:29:51Z")

</div>

How long did it take you to index that data volume? By default I think ILM only checks every 5 or 10 minutes which is fine for real use cases but can impact small tests like this.

---

<div class="post-metadata">

**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\
**Post date:** [September 17, 2019, 6:19pm UTC](https://discuss.elastic.co/t/index-lifecycle-maanagement-policy-how-does-it-work/199501/4 "2019-09-17T18:19:56Z")

</div>

It could be but I set Lifecycle poll interval to 1 sec

```auto
 "indices.lifecycle.poll_interval":"1s

```

So I don't think this is the issue

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2019, 6:19pm UTC](https://discuss.elastic.co/t/index-lifecycle-maanagement-policy-how-does-it-work/199501/5 "2019-10-15T18:19:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.