Make all current indexes use another Index Lifecycle Management policy that has a hot-delete phase?

Elastic Stack Elasticsearch
1

Hello

Piggybacking on my previous topic, Implement Hot-Warm-Cold-Frozen-Delete phases with only one node but multiple storage destinations? I created a Index Lifecycle Management policy that has a hot phase, rollsover to x days and I imagine that goes into the delete phase where it is deleted.

That seems all good but reading the documentation, it seems I have a issue with my indexes and its current policy

My current indexes seem to have a "default" policy assiged so to speak where there is only a hot phase designed. I would like switch all my current indexes so, like my new indexes, they get deleted after x days.

I seem to be confused because although I know I can assign a new ILM policy to current indexes, they dont get applied until they switch phase (which will never happen in this case)

Can someone please clear it up for me?

Thanks

2

Have you followed Manage existing indices | Elasticsearch Guide [7.12] | Elastic to integrate those existing indices into your policy?

3

That does look intresting (more so the wildcard character). Thanks.

All my indexes are named timebased (example: "winlogbeat-winsecurity-2021.05.20" ) I already have created my ILM policy that has a hot and a delete phase. I dont have a alias (as I dont understand the concept well, sorry) How can I get this work?

Thank you very much

4

If you're using the traditional time based indices, you will need to change your Beats setup to use ILM.

5

I just noticed that I left out a very important detail.

All my logs pass thru Logstash and it gets sent to Elasticsearch. So for example, in a Logstash configuration file I have, if I set it to use my new ILM policy, it seems to work.

But the other indexes? They dont seem to have it assigned.

6

Right, then in that case you need to make sure all your index patterns have applicable ILM patterns assigned to them in Elasticsearch.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.