Hi,
I have an ElasticCloud that I want to setups indexes on it and a policy to delete the old logs.
I have created a lifecycle policy for deleting the logs which are older that 30 days:
PUT _ilm/policy/deleting_policy
{
"policy": {
"phases": {
"hot": {
"actions": {
"rollover": {
"max_size": "50GB"
}
}
},
"delete": {
"min_age": "30d",
"actions": {
"delete": {}
}
}
}
}
}
I created an Index template as following:
PUT _component_template/template1
{
"template": {
"mappings": {
"properties": {
"@timestamp": {
"type": "date"
},
"ttlInDays": {
"type": "integer"
},
"@log_group": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"@message": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"@owner": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"message": {
"type": "text"
}
}
}
}
}
PUT _index_template/template_1
{
"index_patterns": ["mytestindex*"],
"template": {
"settings": {
"number_of_shards": 1,
"index.lifecycle.name": "deleting_policy",
"index.lifecycle.rollover_alias": "alias1"
},
"mappings": {
"_source": {
"enabled": false
}
},
"aliases": {
"alias1" : {},
"{index}-001" : {}
}
},
"priority": 200,
"composed_of": ["template1"],
"version": 3,
"_meta": {
"description": "my template"
}
}
After creating an Index, I get this error in the rollover part:
PUT /mytestindex
illegal_argument_exception: index name [mytestindex] does not match pattern '^.*-\d+$'
I have checked the following link but it didn't help me, even running the exact command on this link, gives an error:
https://www.elastic.co/guide/en/elasticsearch/reference/5.4/indices-rollover-index.html
I just want to setup a policy that deletes the old logs.
I would appreciate if anyone can help with this issue.