Hi People,
I'm having an issue with our ILM set up. Well, I think it's related to our ILM policy. We use ElasticSearch 7.
The policy rolled from 00001 to 00002 and suddenly it stopped processing data from our applications. See:
The applications use SeriLog to send its logs, they use the following config:
"logging": {
"Serilog": {
"WriteTo": [
{
"Name": "Elasticsearch",
"Args": {
"nodeUris": "http://es-cluster:9200/",
"autoRegisterTemplate": "true",
"autoRegisterTemplateVersion": "ESv6",
"templateName": "app-serilog-events-template",
"indexFormat": "app-index",
"bufferBaseFilename": "/opt/app/logs/buffer-app",
"restrictedToMinimumLevel": "Debug"
}
}
]
},
The ILM policy looks like:
PUT _ilm/policy/hot-warm-app
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_size": "50gb",
"max_age": "30d"
},
"set_priority": {
"priority": 100
}
}
},
"warm": {
"min_age": "2d",
"actions": {
"forcemerge": {
"max_num_segments": 1
},
"set_priority": {
"priority": 50
},
"shrink": {
"number_of_shards": 1
}
}
},
"delete": {
"min_age": "60d",
"actions": {
"wait_for_snapshot": {
"policy": "Weekly-App-Indices"
}
}
}
}
}
}
I couldn't find any errors in the logs of ElasticSearch nor in the application.
Thanks in advance!