Index rollover latency

I have created an ILM policy as follows,

{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_docs": 30
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "delete": {
        "min_age": "15m",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

Index setting as follows,

{
  "index": {
    "lifecycle": {
      "name": "index-roll+doc-over",
      "rollover_alias": "router01"
    },
    "number_of_shards": "1",
    "number_of_replicas": "0"
  }
}

As you have already guessed, I am testing this ILM rollover policy which is why I have set the document size only 30. I am planning to limit the doc size of 1.5 Billion. But I am observing huge latency while creating a rollover index and switching to the new index. It is writing on the current index and not rolling over. For the test I have ingested only 500 lines of log.

Index details

health status index                    uuid                   pri rep docs.count docs.deleted store.size pri.store.size

green  open   router01-000001          654G2ArFQiypDn9U69jedw   1   0        500            0    151.1kb        151.1kb

And at the time of writing this question, the other index (router01-000001) is not created yet.

The the _ilm/explain is following,

{
  "indices" : {
    "router01-000001" : {
      "index" : "router01-000001",
      "managed" : true,
      "policy" : "index-roll+doc-over",
      "lifecycle_date_millis" : 1583819391191,
      "age" : "14.08m",
      "phase" : "hot",
      "phase_time_millis" : 1583819391396,
      "action" : "rollover",
      "action_time_millis" : 1583819706013,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1583819706013,
      "phase_execution" : {
        "policy" : "index-roll+doc-over",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_docs" : 30
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "version" : 1,
        "modified_date_in_millis" : 1583756555777
      }
    }
  }
}

Elasticsearch currently has 2GB heap and logstash has 1GB. Total Memory 4GB.
{
UPDATE:

  • I have start ingesting larger file and after storing 15500 docs it rolled over to new index.

My question is,

  • Is the latency expected (May be I misunderstood the rollover concept)
  • Did I mistake anywhere?
  • If not than what can I do to improve the latency as there will be 20 millions log will be ingested per day

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.