Logstash not getting rolled over

Elastic Stack Elasticsearch
1

The logstash file is not getting rolled over. the setup was set for 5 MB and the lifecyle policy added to it. But it grew to 100 GB. No one noticed it until we started getting the server utilization alerts. How do I create a new index ? can i stop the logstash file and delete it ?

2

By file you do you mean index?

3

Yes, indexes.

4

Righto, then you will need to share your policy and an explain on it.

5

This is the policy we have.

{
  "policy": "logstash-policy",
  "phase_definition": {
    "min_age": "0ms",
    "actions": {
      "rollover": {
        "max_size": "80gb",
        "max_age": "7d"
      }
    }
  },
  "version": 4,
  "modified_date_in_millis": 1643893745244
}

========================

It was earlier set to roll over at 5 GB. Roll over did not happen. when i checked it was around 78 GB and i changed the max size to 80 GB. But still did not happen.

I also see the error:
illegal_argument_exception: index.lifecycle.rollover_alias [logstash] does not point to index [logstash]

6

Where is that error?
What does an explain on the policy show?

7

This below is the error:

This is the logstash_Policy code:

PUT _ilm/policy/logstash-policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_age": "7d",
            "max_size": "80gb"
          }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}
8

Hi pls find the explain output:

[xxxxxxxxxx ~]$ curl -X GET "localhost:9200/logstash*/_ilm/explain?pretty"
{
  "indices" : {
    "logstash" : {
      "index" : "logstash",
      "managed" : true,
      "policy" : "logstash-policy",
      "lifecycle_date_millis" : 1614378182107,
      "age" : "354.68d",
      "phase" : "hot",
      "phase_time_millis" : 1645022884107,
      "action" : "rollover",
      "action_time_millis" : 1614378281319,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1645022884107,
      "is_auto_retryable_error" : true,
      "failed_step_retry_count" : 25531,
      "phase_execution" : {
        "policy" : "logstash-policy",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "80gb",
              "max_age" : "7d"
            }
          }
        },
        "version" : 4,
        "modified_date_in_millis" : 1643893745244
      }
    }
  }
}
[xxxxxxxxxxxxxx ~]$
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.