Is external intervention needed to roll indexes?

[amhulli (Andrew)]

Been reading through old questions and seem to be getting some conflicting results about rolling of indexes. I'm using v7.4.2 for my Filebeat => Logstash => Elasticsearch => Kibana stack. I'm still a newbie and am hoping for a definitive answer to this question if possible:

Do I need to have a cron job that rolls the index daily or is there something within ES that can do this without cron?

I have an ILM Policy with rules of 20Gb / 1d. I'm unsure if this should be rolling the indexes (seems not because it isn't) or if the rollover API needs to be called by something like cron and will roll the index if either of those two conditions have been met/exceeded.
Please save my sanity.....

[Christian_Dahlqvist]

Rollover is great if you want your indices to be of reasonably even size and do not require indices to be cut at a specific period as it allows the generation of new indices to be determined by a combination of size and age. It does however require a API call to evaluate whether an index should roll or not. If you strictly want a daily index, then avoid rollover and instead go with the traditional named approach.

This is where ILM comes in as it will automatically handle the rollover API calls periodically if you configure your policy to use rollover. AS index size can grow and shrink over time as data merges, I believe ILM estimates the size based on document count and average size. You also have transaction logs that may or may not count.