Index Policies Never Rollover to the Defined Index Life-cycle Policy

Elastic Stack Elasticsearch
#1

No matter what how I edit the index policies. The indexes never roll over to Warm tier.

My indexes just goes straight from hot to delete. Even though my index policy says the following:

PUT _ilm/policy/filebeat
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "forcemerge": {
            "max_num_segments": 1
          },
          "rollover": {
            "max_size": "15gb",
            "max_age": "7d"
          },
          "set_priority": {
            "priority": 100
          },
          "shrink": {
            "number_of_shards": 1
          }
        }
      },
      "warm": {
        "min_age": "30d",
        "actions": {
          "forcemerge": {
            "max_num_segments": 1
          },
          "set_priority": {
            "priority": 75
          },
          "shrink": {
            "number_of_shards": 1
          }
        }
      },
      "cold": {
        "min_age": "7d",
        "actions": {
          "freeze": {},
          "set_priority": {
            "priority": 50
          }
        }
      },
      "delete": {
        "min_age": "7d",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": true
          }
        }
      }
    }
  }
}
#2

Can you show an _explain for that policy?

#3

Your policy has a min_age for the warm phase of 30d, but then the cold and delete phases both have a min_age of 7d. This means that once your index hits the warm phase, it executes the actions in the warm phase, then goes directly to the cold, executes those, then directly goes to the delete phase and deletes the index.

Generally you'll always want the min_age to be getting increasingly longer, so something like 30d for warm, 45d for cold, and 60d for delete.

1 Like
#4

@dakrone would it make sense for the code to enforce incremental ages to prevent this?

#5

@warkolm we could enforce >=, but not >, as it's still valid to have a policy that just runs through actions sequentially regardless of timing (for instance, 0d for both a warm and cold phase).

1 Like
#6

I'm trying to make it do this.

7 Days = Hot

30 Days = Warm

7 Days = Cold

7 Days = Delete

#7

What would _explain for filebeat policy look like. I've never used that query before.

#8

ILM timings are absolute time. So you'd need something like:

  • warm - min_age: 7d
  • cold - min_age: 37d
  • delete - min_age: 44d

This means "enter the warm phase after the index is 7 days old[1]", then "enter the cold phase after the index is 37 days old", then "delete the index when it is 44 days old".

The 44 is 7 + 30 + 7 = 44.

[1]: technically it's calculated based on the time rollover completes, but calling it "age" is easier to reason about.

#9 
{
  "indices" : {
    "filebeat-7.10.0-2021.02.16-000048" : {
      "index" : "filebeat-7.10.0-2021.02.16-000048",
      "managed" : true,
      "policy" : "filebeat",
      "lifecycle_date_millis" : 1614030669690,
      "age" : "10.88d",
      "phase" : "hot",
      "phase_time_millis" : 1613733539746,
      "action" : "complete",
      "action_time_millis" : 1614030672843,
      "step" : "complete",
      "step_time_millis" : 1614030672843,
      "phase_execution" : {
        "policy" : "filebeat",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "15gb",
              "max_age" : "7d"
            }
          }
        },
        "version" : 16,
        "modified_date_in_millis" : 1613433116392
      }
    }
  }
}
#10

Here you can see that the index is 10.88 days old, not old enough yet to entire the warm phase, which is configured with min_age: "30d"

#11

Oh Okay. I was looking at it in the wrong way. I read so much documentation about it, but you cleared it up way easier then the documentation.

#12

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.