Index rollover is not happening

[bivaswap (Bivas Mandal)]

I have 4 node cluster (3 master eligible+data, 1 coordinating node)

Logstash output

output {
  elasticsearch {
    hosts => ["es-node-01.xyz.local:9200", "es-node-02.xyz.local:9200", "es-node-03.xyz.local:9200"]
    ilm_rollover_alias => "aws"
    ilm_policy => "aws-ilm-policy"
    template => "/etc/logstash/aws-beats.conf.d/aws.json"
    template_name => "aws"
    template_overwrite => true
    user => "${ES_USER}"
    password => "${ES_PWD}"
  }
}

GET aws-2020.06.24-000001/_ilm/explain
{
  "indices" : {
    "aws-2020.06.24-000001" : {
      "index" : "aws-2020.06.24-000001",
      "managed" : true,
      "policy" : "aws-ilm-policy",
      "lifecycle_date_millis" : 1592996386205,
      "age" : "15.75d",
      "phase" : "hot",
      "phase_time_millis" : 1592996386331,
      "action" : "rollover",
      "action_time_millis" : 1592996695435,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1592996695435,
      "phase_execution" : {
        "policy" : "aws-ilm-policy",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "25gb",
              "max_age" : "30d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "version" : 1,
        "modified_date_in_millis" : 1591798442850
      }
    }
  }
}

GET _ilm/status
{
  "operation_mode" : "RUNNING"
}

GET _alias/aws
{
  "aws-2020.06.24-000001" : {
    "aliases" : {
      "aws" : {
        "is_write_index" : true
      }
    }
  }
}

GET /_cluster/settings
{
  "persistent" : {
    "indices" : {
      "lifecycle" : {
        "poll_interval" : "10m"
      }
    },
    "xpack" : {
      "monitoring" : {
        "collection" : {
          "enabled" : "true"
        }
      }
    }
  },
  "transient" : { }
}

Everything looks normal, but still index is not rolling over/splitting.
Can anyone help me with that ?

[dakrone (Lee Hinman)]

The rollover date that's being used is cached in the phase_definition, you can see:

        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "25gb",
              "max_age" : "30d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },

That the max_age is 30 days, however, the index is only 15.75 days old. If you are expecting it to roll over from size, keep in mind that the 25gb is the primary shard combined sizes, not the entire index size. Perhaps you can share the size of the index?

[bivaswap (Bivas Mandal)]

Yes,
I misunderstood the indices size.
It consider pri.store.size, not store.size.

Index rolled over, everything going good.