Index RollOver policy and deleting logs after specific time

Hi,
I have an ElasticCloud that I want to setups indexes on it and a policy to delete the old logs.
I have created a lifecycle policy for deleting the logs which are older that 30 days:

    PUT _ilm/policy/deleting_policy
    {
      "policy": {
        "phases": {
          "hot": {
            "actions": {
              "rollover": {
                "max_size": "50GB" 
              }
            }
          },
          "delete": {
            "min_age": "30d",
            "actions": {
              "delete": {} 
            }
          }
        }
      }
    }

I created an Index template as following:

     PUT _component_template/template1
    {
      "template": {
        "mappings": {
          "properties": {
            "@timestamp": {
              "type": "date"
            },
            "ttlInDays": {
              "type": "integer"
            },
            "@log_group": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "@message": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "@owner": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "message": {
              "type": "text"
            }  
          }
        }
      }
    }

    PUT _index_template/template_1
    {
      "index_patterns": ["mytestindex*"],
      "template": {
        "settings": {
          "number_of_shards": 1,
          "index.lifecycle.name": "deleting_policy", 
          "index.lifecycle.rollover_alias": "alias1"
        },
        "mappings": {
          "_source": {
            "enabled": false
          }
        },
       "aliases": {
          "alias1" : {},
          "{index}-001" : {}
        }
      },
      "priority": 200,
      "composed_of": ["template1"],
      "version": 3,
      "_meta": {
        "description": "my template"
      }
    }

After creating an Index, I get this error in the rollover part:

    PUT /mytestindex

illegal_argument_exception: index name [mytestindex] does not match pattern '^.*-\d+$'

I have checked the following link but it didn't help me, even running the exact command on this link, gives an error:
https://www.elastic.co/guide/en/elasticsearch/reference/5.4/indices-rollover-index.html

I just want to setup a policy that deletes the old logs.
I would appreciate if anyone can help with this issue.

What version of kibana are you using? Have you tried using the UI to create your policy? Have you followed the steps in https://www.elastic.co/guide/en/kibana/current/creating-index-lifecycle-policies.html?

Hi,
It is version v7.9.0. I have tried it through UI and it gives me the same error:

Index lifecycle error

illegal_argument_exception: index name [mytestindex] does not match pattern '^.*-\d+$'

After changing the index name to this: mytestindex-000001 it seems it is fine now and it doesn't give me the error anymore.

    PUT /mytestindex-000001
    {
      "aliases": {
        "mytestindex": {
          "is_write_index": true
        }
      }
    } 

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.