Index lifecycle management usages

Elastic Stack Elasticsearch
1

Hi I am using this iLm features to save the space on my system but I am bit confused with its policy. A little help would be very appreciated...
I have decided to keep the index in below format
HOT
Warm - 7 Days from index creation
Cold- 7 Days from index creation
Delete - 7 Days from index creation
Does it means that indices will go in Warm phase after 7 days of indices creation or after 7 days of going in warm phase it will go in cold phase..i.e. it will go in cold phase after 14 days of index creation?? Hope I am able to make sense

2

If you're referring to the min_age field, that age is the total age from when the index was created, or if the policy has a rollover action, from when the index rolled over.

For example, if I have a policy like this:

PUT _ilm/policy/sample_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_age": "7d"
          }
        }
      },
      "warm": {
        "min_age": "30d",
        "actions": {
          "forcemerge": {
            "max_num_segments": 1
          }
        }
      },
      "cold": {
        "min_age": "60d",
        "actions": {
          "allocate": {
            "require": {
              "type": "cold"
            }
          }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

After 7 days the index will be rolled over. 30 days after that, the index will enter the warm phase and be force merged. 30 days after that (60 days after rollover), it will be allocated to cold nodes, and 30 days after that (90 days total after rollover), it will be deleted.

If you're not using rollover, for example with this policy:

PUT _ilm/policy/sample_policy_no_rollover
{
  "policy": {
    "phases": {
      "warm": {
        "min_age": "7d",
        "actions": {
          "shrink": {
            "number_of_shards": 1
          }
        }
      },
      "cold": {
        "min_age": "14d",
        "actions": {
          "allocate": {
            "require": {
              "type": "cold"
            }
          }
        }
      },
      "delete": {
        "min_age": "21d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

This would shrink the index 7 days after the index is created, reallocate it to cold nodes 14 days after the index is created, and delete it 21 days after it is created.

You can also reference the documentation on timing of ILM policies for another explanation.

Does that help?

1 Like
3

Just to be extra clear, if you wrote a policy like this:

PUT _ilm/policy/sample_policy
{
  "policy": {
    "phases": {
      "warm": {
        "min_age": "7d",
        "actions": {
          "forcemerge": {
            "max_num_segments": 1
          }
        }
      },
      "cold": {
        "min_age": "7d",
        "actions": {
          "allocate": {
            "require": {
              "type": "cold"
            }
          }
        }
      },
      "delete": {
        "min_age": "7d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

Where all the min_age fields are set to the same time, all of the actions will be performed in order 7 days after the index was created. On the 7th day, it would be force merged, then immediately reallocated to cold nodes, then deleted right after that. This is rarely what you want.

1 Like
4

Thanks

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.