# Index Rollover not working after reaching maxday **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [July 7, 2022, 2:12am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066 "2022-07-07T02:12:34Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jacky7788](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jacky7788/32/108007_2.png) [@jacky7788](https://discuss.elastic.co/u/jacky7788)\ **Post date:** [July 7, 2022, 2:12am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/1 "2022-07-07T02:12:34Z")
Not able to rollover after 1 day I have set parse\_origination\_date to true the index is like access-log-appname-2022.07.06-000001 ```auto { "policy":{ "phases":{ "hot":{ "min_age":"0ms", "actions":{ "rollover":{ "max_age":"1d" }, "set_priority":{ "priority":100 } } }, "warm":{ "min_age":"1d", "actions":{ "set_priority":{ "priority":50 } } }, "delete":{ "min_age":"2d", "actions":{ "delete":{ "delete_searchable_snapshot":true } } } } } } ``` ```auto { "indices": { "access-log-w302-2022.07.06-000001": { "index": "access-log-appname-2022.07.06-000001", "managed": true, "policy": "7-days-access-log", "lifecycle_date_millis": 1657065600000, "age": "1.08d", "phase": "hot", "phase_time_millis": 1657095639572, "action": "rollover", "action_time_millis": 1657095639972, "step": "check-rollover-ready", "step_time_millis": 1657095639972, "phase_execution": { "policy": "7-days-access-log", "phase_definition": { "min_age": "0ms", "actions": { "set_priority": { "priority": 100 }, "rollover": { "max_age": "1d" } } }, "version": 1, "modified_date_in_millis": 1657095074154 } } } } ``` ```auto { "template": { "settings": { "index": { "lifecycle": { "name": "7-days-access-log", "parse_origination_date": "true", "rollover_alias": "access-log" }, "number_of_shards": "1" } }, "mappings": { "properties": { "@timestamp": { "type": "date" }, "aa": { "type": "text" } } }, "aliases": {} } } ``` I expect it will create a new index access-log-appname-2022.07.07-000001 after it reach the max day. or I understand it wrong, plz help ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 7, 2022, 6:31am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/2 "2022-07-07T06:31:06Z")
Is the name of the policy you showed `7-days-access-log` (I do not see anything related to 7 days in it...)? > [@jacky7788](#): > > I expect it will create a new index access-log-appname-2022.07.07-000001 after it reach the max day. The sequence number is monotonically incrementing and not per day, so the next index would end in `-000002`. ---
**Author:** ![jacky7788](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jacky7788/32/108007_2.png) [@jacky7788](https://discuss.elastic.co/u/jacky7788)\ **Post date:** [July 7, 2022, 10:01am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/3 "2022-07-07T10:01:46Z")
oh, I changed the delete min\_age from 7d to 2d and I think it is not using origination\_date it created a new index access-log-appName-2022.07.07-000002 at 2022-07-07 16:20:41 instead of 2022-07-07 00:00:00 ```auto { "indices": { "access-log-w302-2022.07.06-000001": { "index": "access-log-appName-2022.07.06-000001", "managed": true, "policy": "7-days-access-log", "lifecycle_date_millis": 1657065600000, "age": "1.41d", "phase": "warm", "phase_time_millis": 1657182041364, "action": "complete", "action_time_millis": 1657182041764, "step": "complete", "step_time_millis": 1657182041764, "phase_execution": { "policy": "7-days-access-log", "phase_definition": { "min_age": "1d", "actions": { "set_priority": { "priority": 50 } } }, "version": 1, "modified_date_in_millis": 1657095074154 } } } } ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 7, 2022, 10:07am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/4 "2022-07-07T10:07:30Z")
Rollover is based on the index creation date and not the date you put in the name. If the `000001` index was created around `16:20:41` the rollover to the `000002` should happen approximately 24 hours later if you have configured rollover for 1 day. What you are seeing is therefore expected. The whole point of rollover is that you will roll over to a new index based on age or size, as this will allow you to achieve a reasonably uniform shard size. This was never designed to roll over at specific times as that would defeat the main purpose. If you want strictly day based indices, determine the indexname based on the timestamp before you index and do not use rollover. ---
**Author:** ![jacky7788](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jacky7788/32/108007_2.png) [@jacky7788](https://discuss.elastic.co/u/jacky7788)\ **Post date:** [July 7, 2022, 10:10am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/5 "2022-07-07T10:10:26Z")
but I have set index.lifecycle.parse\_origination\_date to true will the rollover action use origination\_date of the index as begin time? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 7, 2022, 10:11am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/6 "2022-07-07T10:11:16Z")
Yes. If you want indices to cover specific time periods, do not use rollover. Before rollover was available using indices covering fixed time periods based on the index name was the standard. This is still available and still supported by Logstash and may be better for you. ---
**Author:** ![jacky7788](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jacky7788/32/108007_2.png) [@jacky7788](https://discuss.elastic.co/u/jacky7788)\ **Post date:** [July 7, 2022, 10:16am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/7 "2022-07-07T10:16:39Z")
I was trying to use rollover to delete specific time period indices after N days. thought they can use together. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 7, 2022, 10:22am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/8 "2022-07-07T10:22:18Z")
Time-based indices rely on managing data retention by deleting complete indices. If you have a specific target retention period you are therefore likely to always have a certain amount of data in the cluster that has exceeded the retention period. In many use cases users require at least X days of data to be available, but do not mind if a little extra data is available from time to time. This is where rollover shines - as long as you do not need to control the deletion and exact amount of extra data available in detail you can let indices cover more flexible time periods and better control their size, which is quite important for optimum performance. If you are not willing to relinquish this control, rollover and the benefits it brings might not be for you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 4, 2022, 10:22am UTC](https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/9 "2022-08-04T10:22:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.