Is it possible to delaying shrink and forcemerge lifecycle steps in hot tier

Elastic Stack Elasticsearch
1

Hi All,
Need some information about setting up ILM policy like below for time series data stream.

      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_age": "10d",
            "max_size": "20gb",
            "max_primary_shard_size": "10gb"
          },
          "forcemerge": {
            "max_num_segments": 1
          },
          "set_priority": {
            "priority": 100
          },
          "shrink": {
            "number_of_shards": 1,
            "allow_write_after_shrink": true
          }
        }
      },

Here

  1. Once the rollover is done, new index is created and there is 30m period where old index still accepts data.
  2. After this, new index starts receiving data and Old index start to go in shrink execution.

Is it possible to have some delay between #2 step. When old index's end-time is passed, is it possible to delay shrink by some time like 1h etc. To make sure that we dont get any write rejections in case if the old index timestamps data is still delayed for some reason. (Mostly asking this from hot tier)

2

Hello @Vivek_Shinde

As per my understanding we can try using the Warm Phase, so logic will be post rollover of the index from Hot phase, after 30 minutes/1 hour we can move the index to Warm Phase & as part of this phase we shrink the index, if needed we can even make it readyonly.

"warm": {
        "min_age": "30m",
        "actions": {
          "readonly": {},
          "shrink": {
            "number_of_shards": 1
          },
          "forcemerge": {
            "max_num_segments": 1
          },
          "set_priority": {
            "priority": 50
          }
        }
      }

Thanks!!

3

Yes, this works with warm movement. But problem is mainly from the perspective that, lets say we do downsampling via ILM in warm phase - In above case, downsampling will get triggered immediately as soon as it goes in warm phase (after 30m configured as minAge in warm). What I was trying to achive is as follows -

  1. Hot data index -> rollover -> (missing piece - wait for some time e.g. 1h) -> in hot phase itself do shrink + forcemerge
  2. Have warm phase with min_age = 10d (so, that data stays in hot with initial periodicity for e.g 10 days)
  3. Then movement to warm will happen and do downsampling post 10 days.
4

Hello,

Thank you for sharing the details.

  1. Could you please confirm if you have separate HOT/WARM data nodes configured ?
  2. If yes than your requirement i can understand that you want to keep the index on HOT Node (hot phase) for 10 days with shrink (applied after delay of 30 minutes post rollover of index) & post that this index is pushed after 10 days to WARM Node (warm phase).
  3. If no separate nodes are there than what is the difference if we rollover in HOT phase or WARM phase?
  4. For the delay part during the rollover i am not aware how we can apply this logic in HOT phase itself.

Thanks!!