Kibana: Cold indices not showing when using filter in index management

Elastic Stack Kibana
1

I have a two node cluster with a master/hot and a single data node defined in cold tier. I have created few indices for testing data tier. But when I apply "lifecycle phase" filter the indices supposed to be in cold tier is not listing, at the same time 'hot' are listing if I change filter value to 'hot'. If I don't use any filter all indices are listed including 'hot' and 'cold'. The reason I say they are cold tier is that If I query GET /_cat/shards/ using Dev tools I can see it's residing in cold node. If I click any one of the cold index I can see there is no errors and current phase showing as 'completed'. What can be the reason it's not showing in filter when select 'cold' or am I missing something?

PUT _ilm/policy/hex_rollover
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_docs": 5
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "cold": {
        "min_age": "1h",
        "actions": {
          "allocate": {
            "include": {},
            "exclude": {},
            "require": {
              "node_type": "cold"
            }
          },
          "set_priority": {
            "priority": 0
          }
        }
      }
    }
  }
}
2

Hi,

In your case, the "min_age" for the cold phase is set to "1h", which means the cold phase actions (like moving the index to the cold node) start 1 hour after the index enters the hot phase. However, the index is still considered to be in the hot tier until these actions are completed.

If you want to see the indices in the cold tier when you apply the "lifecycle phase" filter, you might need to wait until the cold phase actions have been completed. You can check the status of these actions by looking at the ILM explain API.

Regards

3

The indices are already in cold node which I can see using GET /_cat/shards/ and also these indices are created and rolled over days ago. When I apply 'hot' filter only the current write index is listed. None of other phase is listing rest of indices but when I remove filter all indices are listed. In below image db2 is my cold node.

Screenshot 2024-01-03 at 9.27.10 AM
Screenshot 2024-01-03 at 9.27.10 AM977×152 63.2 KB

4

Can you share a screenshot of what you are seeing in Index Management?

It is really not clear what is your issue, but if filter by the lifecycle phase and choose hot, only the index in the hot phase will be shown, indices already in other lifecycle phases, like rolled over indices, will not be shown.

5

Screenshot 2024-01-03 at 10.52.39 AM
Screenshot 2024-01-03 at 10.52.39 AM1207×317 48.1 KB

Here when I select 'cold' why indices in the cold node are not listed. If you see my my previous screenshot there you can see except '000007' write index all indices are on db2 which is my cold node.

6

Hi,

Could you execute this command:

GET _cat/nodes?v

7

Please share the elasticsearch.yml of both of your nodes.

Also, run the request GET <target>/_ilm/explain for one of your old indices and share the result.

Like GET hex-data-000001/_ilm/explain

8

GET hex-data-000001/_ilm/explain gives this

{
  "indices" : {
    "hex-data-000001" : {
      "index" : "hex-data-000001",
      "managed" : true,
      "policy" : "hex_rollover",
      "lifecycle_date_millis" : 1703211314319,
      "age" : "13.04d",
      "phase" : "completed",
      "phase_time_millis" : 1703214920429,
      "action" : "completed",
      "action_time_millis" : 1703214920429,
      "step" : "completed",
      "step_time_millis" : 1703214920429,
      "phase_execution" : {
        "policy" : "hex_rollover",
        "version" : 1,
        "modified_date_in_millis" : 1703140459345
      }
    }
  }
}
9

You didn't share the elasticsearch.yml of your nodes as asked.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.