Index Policy not taking effect on the specified indexes

Elastic Stack Elasticsearch
1

Hey Guys,

I tried applying default 90_days_log_retention policy to my monitoring-es indexes, but it gets deleted after the 7th day. Not sure where it went wrong.

settings1
settings11385×788 190 KB

This is settings as per ILM policy for 90 days :

{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"set_priority": {
"priority": 100
}
}
},
"warm": {
"min_age": "2d",
"actions": {}
},
"cold": {
"min_age": "30d",
"actions": {}
},
"delete": {
"min_age": "120d",
"actions": {
"delete": {}
}
}
}
}
}

2

There is the default system managed policy that might be a higher priority, try checking with an GET _ilm/policy.

3

Below is the output for : GET _ilm/policy

{
"90_days_log_retention" : {
"version" : 6,
"modified_date" : "2022-06-20T07:17:39.854Z",
"policy" : {
"phases" : {
"warm" : {
"min_age" : "2d",
"actions" : { }
},
"cold" : {
"min_age" : "30d",
"actions" : { }
},
"hot" : {
"min_age" : "0ms",
"actions" : {
"set_priority" : {
"priority" : 100
}
}
},
"delete" : {
"min_age" : "120d",
"actions" : {
"delete" : { }
}
}
}
}
}
}

=============================================================

This output is for : GET .monitoring-es-6-2022.06.16/_ilm/explain
{
"indices" : {
".monitoring-es-6-2022.06.16" : {
"index" : ".monitoring-es-6-2022.06.16",
"managed" : true,
"policy" : "90_days_log_retention",
"lifecycle_date_millis" : 1655337604604,
"phase" : "warm",
"phase_time_millis" : 1655709459898,
"action" : "complete",
"action_time_millis" : 1655653998591,
"step" : "complete",
"step_time_millis" : 1655709459898,
"phase_execution" : {
"policy" : "90_days_log_retention",
"phase_definition" : {
"min_age" : "2d",
"actions" : { }
},
"version" : 6,
"modified_date_in_millis" : 1655709459854
}
}
}
}

4

If you look at the subscriptions page it states that configurable retention period requires a commercial license. I believe the free basic license is limited to 7 days retention.

5

I have a Platinum license

6

Then I would recommend contacting Support.

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.