No new data getting indexed after disabling rollover in ILM

Hello,

We have implemented ILM for indexes recently. We have a rollover policy for hot tier that gets triggered when the index gets larger than 40gb. This particular change did not go well with the policy, as it had alias error. Hence, the indexes grew up to 100gb on average. I tried adding alias and rollover_alias to index templates and retry the ILM policy, but no avail. These larger indices were having serious performance issue with our cluster, hence, I disabled the rollover policy for the ILM to successfully happen. Disabling rollover did make the ILM to happen successfully, but I dont see any new indices getting created in hot tier and therefore no data is visible in kibana. I tried our monitoring cluster to find if there is anything wrong, but could not find anything. The agents installed in machines are also okay.
Thanks,
Divya

Welcome to our community! :smiley:

It'd be useful if you could share your policy, as well as an explain on the policy state.

If you have replica: 1, which is the default, having ~80GB index size sounds right, but not ~100GB.
You may also want to share your index naming convention, because this matters for ILM to work properly.
Adding alias and rollover_alias to the index template will only affect new indexes, but not existing ones, hence you will need to set the alias and rollover_alias to the currently active index as well.

Hello Hendry,
What you told about index template affecting only new indices is very true. So using manual rollover is one way of fixing it as new indices will be created in hot tier.
The indexing started once I rolled over manually to create new indexes. Since I disabled rollover in the ILM policy and all existing indices moved to other tiers, hot tier is left with no indexes and it stopped the indexing data altogether. Hence, manual rollover fixed the issue. So I could see the data being indexed again.
Appreciate all your help.
Thanks,
Divya.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.