We have a data stream created by Logstash and it's using the default index template and ILM policy. My understanding is that the data stream should roll over to a new index once the initial index has 50 GB of data or is 30 day sold. However, there's only one index and it's over 51 GB (Update: now over 55 GB). Shouldn't it have rolled over by now? Thanks for the help.
It's likely that storage size represents the total of both primaries and the replicas shards.
ILM will rollover looks specifically at primary shard size only.
Ah, you might be right. I didn't realize that there was 1 replica by default. I have confirmed now that the primary shard is about half of the size reported on this page. Thanks!
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.