# Question about "Rollover" in Index Lifecycle Policy

**URL:** <https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005>\
**Category:** Kibana\
**Tags:** ilm-index-lifecycle-management\
**Created:** [September 13, 2021, 6:16am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005 "2021-09-13T06:16:18Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![vp096](https://avatars.discourse-cdn.com/v4/letter/v/da6949/32.png) [@vp096](https://discuss.elastic.co/u/vp096)\
**Post date:** [September 13, 2021, 6:16am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/1 "2021-09-13T06:16:18Z")

</div>

Hello to all,

I have a question when I configure my first "Index Lifecycle Policy". I am given the following option:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/0/804874523704f53b5b49c875e862339d5206c434.png)

Is this a problem or a risk of data loss if I don't enable it? Because I want to keep my data for 365 days without ever having to modify it.

Thank you in advance for your help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 13, 2021, 6:19am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/2 "2021-09-13T06:19:59Z")

</div>

Rollover is when you create a new index, it doesn't delete the data.  
There will be a section later in the policy that lets you configure when rolled indices are deleted.

---

<div class="post-metadata">

**Author:** ![vp096](https://avatars.discourse-cdn.com/v4/letter/v/da6949/32.png) [@vp096](https://discuss.elastic.co/u/vp096)\
**Post date:** [September 13, 2021, 6:27am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/3 "2021-09-13T06:27:16Z")

</div>

Thank's @warkolm for the reply.

Ok I see. But it's also possible to not use the rollover and just choose to delete entries older than 365 days?

For example, I keep my data for 10 days in the "warm" phase, and then I put them for 365 days in the "cold" zone before deleting them. So after 375 days my data will be deleted.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b63067dbefb4d5dd65e44bfc10f0fb2001636301.png)

In fact it is not a problem if I do not use the rollover in my case?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 13, 2021, 6:29am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/4 "2021-09-13T06:29:54Z")

</div>

If you want to do this to need to roll your indices over.  
ILM doesn't delete specific entries/events/documents in an index, it deletes the indices themselves.

---

<div class="post-metadata">

**Author:** ![vp096](https://avatars.discourse-cdn.com/v4/letter/v/da6949/32.png) [@vp096](https://discuss.elastic.co/u/vp096)\
**Post date:** [September 13, 2021, 6:52am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/5 "2021-09-13T06:52:24Z")

</div>

Thank you @warkolm for this clarification.

I'm sorry, I'm new to Elastic, Kibana and Logstash and still some parts are not clear to me.

In practice, I push events to Elastic with Logstash, always with the same index "aruba-logs".

I need to be able to view this data for 365 days and then delete it from elastic. Can you explain me briefly how to do this?

Because if I activate the "Rollover", my index will be modified by what value?

Thank you in advance for your help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 13, 2021, 7:22am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/6 "2021-09-13T07:22:44Z")

</div>

Your best option is to have a read through [ILM: Manage the index lifecycle | Elasticsearch Guide [7.14] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html) to get an idea of how ILM works and the concepts it uses.

Then let us know if you have further questions.

---

<div class="post-metadata">

**Author:** ![vp096](https://avatars.discourse-cdn.com/v4/letter/v/da6949/32.png) [@vp096](https://discuss.elastic.co/u/vp096)\
**Post date:** [September 15, 2021, 10:49am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/8 "2021-09-15T10:49:40Z")

</div>

Finally, what happens when the indexes reach this stage? Does it delete the data older than the chosen value or does it only delete the index?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/2/52e2015f57b5d7471fa94d63a82844c2d62239e1.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 15, 2021, 9:19pm UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/9 "2021-09-15T21:19:57Z")

</div>

It deletes the index.

---

<div class="post-metadata">

**Author:** ![vp096](https://avatars.discourse-cdn.com/v4/letter/v/da6949/32.png) [@vp096](https://discuss.elastic.co/u/vp096)\
**Post date:** [September 16, 2021, 6:01am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/10 "2021-09-16T06:01:13Z")

</div>

I finally find the answers in another post : "Your data resides in your index, if you delete an index, the data is also deleted and space will be freed in the disk"

Thank's for your help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2021, 6:01am UTC](https://discuss.elastic.co/t/question-about-rollover-in-index-lifecycle-policy/284005/11 "2021-10-14T06:01:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
