# Recently rolled index does process data (0 docs) **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [January 15, 2021, 9:19am UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242 "2021-01-15T09:19:45Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Zeroc0pter](https://avatars.discourse-cdn.com/v4/letter/z/34f0e0/32.png) [@Zeroc0pter](https://discuss.elastic.co/u/Zeroc0pter)\ **Post date:** [January 15, 2021, 9:19am UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/1 "2021-01-15T09:19:45Z")
Hi People, I'm having an issue with our ILM set up. Well, I think it's related to our ILM policy. We use ElasticSearch 7. The policy rolled from 00001 to 00002 and suddenly it stopped processing data from our applications. See: ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d1c6e85e4fdeb076c557b2c41cf6b9cfba98caef.png) The applications use SeriLog to send its logs, they use the following config: ```auto "logging": { "Serilog": { "WriteTo": [ { "Name": "Elasticsearch", "Args": { "nodeUris": "http://es-cluster:9200/", "autoRegisterTemplate": "true", "autoRegisterTemplateVersion": "ESv6", "templateName": "app-serilog-events-template", "indexFormat": "app-index", "bufferBaseFilename": "/opt/app/logs/buffer-app", "restrictedToMinimumLevel": "Debug" } } ] }, ``` The ILM policy looks like: ```auto PUT _ilm/policy/hot-warm-app { "policy": { "phases": { "hot": { "min_age": "0ms", "actions": { "rollover": { "max_size": "50gb", "max_age": "30d" }, "set_priority": { "priority": 100 } } }, "warm": { "min_age": "2d", "actions": { "forcemerge": { "max_num_segments": 1 }, "set_priority": { "priority": 50 }, "shrink": { "number_of_shards": 1 } } }, "delete": { "min_age": "60d", "actions": { "wait_for_snapshot": { "policy": "Weekly-App-Indices" } } } } } } ``` I couldn't find any errors in the logs of ElasticSearch nor in the application. Thanks in advance! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 17, 2021, 10:51pm UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/2 "2021-01-17T22:51:46Z")
Can you check the status of the policy - [https://www.elastic.co/guide/en/elasticsearch/reference/7.10/ilm-explain-lifecycle.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/ilm-explain-lifecycle.html)? ---
**Author:** ![Zeroc0pter](https://avatars.discourse-cdn.com/v4/letter/z/34f0e0/32.png) [@Zeroc0pter](https://discuss.elastic.co/u/Zeroc0pter)\ **Post date:** [January 18, 2021, 8:03am UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/3 "2021-01-18T08:03:58Z")
Hi Warkolm, Yes. This is the output: ```auto { "indices" : { "logging-app-000002" : { "index" : "logging-app-000002", "managed" : true, "policy" : "hot-warm-app", "lifecycle_date_millis" : 1610541813496, "age" : "4.8d", "phase" : "hot", "phase_time_millis" : 1610541815123, "action" : "rollover", "action_time_millis" : 1610542413458, "step" : "check-rollover-ready", "step_time_millis" : 1610542413458, "phase_execution" : { "policy" : "hot-warm-app", "phase_definition" : { "min_age" : "0ms", "actions" : { "rollover" : { "max_size" : "50gb", "max_age" : "30d" }, "set_priority" : { "priority" : 100 } } }, "version" : 1, "modified_date_in_millis" : 1607949667311 } } } } ``` This is the index (alias): ```auto { "logging-app-000002" : { "aliases" : { "logging-app" : { } }, "mappings" : { }, "settings" : { "index" : { "lifecycle" : { "name" : "hot-warm-app", "rollover_alias" : "logging-app" }, "routing" : { "allocation" : { "include" : { "_tier_preference" : "data_content" } } }, "number_of_shards" : "1", "provided_name" : "logging-app-000002", "creation_date" : "1610541813496", "priority" : "100", "number_of_replicas" : "1", "uuid" : "KRYPd4cKTjm__sy3-546iQ", "version" : { "created" : "7100099" } } } } } ``` ---
**Author:** ![Zeroc0pter](https://avatars.discourse-cdn.com/v4/letter/z/34f0e0/32.png) [@Zeroc0pter](https://discuss.elastic.co/u/Zeroc0pter)\ **Post date:** [January 19, 2021, 8:13am UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/4 "2021-01-19T08:13:30Z")
What do you think? ---
**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\ **Post date:** [January 21, 2021, 5:04pm UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/5 "2021-01-21T17:04:40Z")
@Zeroc0pter if you manually index a document into the alias, do you get an error? If you don't get an error, which index does the document get indexed into? ---
**Author:** ![Zeroc0pter](https://avatars.discourse-cdn.com/v4/letter/z/34f0e0/32.png) [@Zeroc0pter](https://discuss.elastic.co/u/Zeroc0pter)\ **Post date:** [January 25, 2021, 8:31am UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/6 "2021-01-25T08:31:33Z")
Hey Dakrone, Thanks for the reply. So stupid of me that I did not try to index a doc myself.. This actually works. I'm thinking of Serilog having issues but not being logged properly. I'll ask the app team to update the Serilog library. ---
**Author:** ![Zeroc0pter](https://avatars.discourse-cdn.com/v4/letter/z/34f0e0/32.png) [@Zeroc0pter](https://discuss.elastic.co/u/Zeroc0pter)\ **Post date:** [January 26, 2021, 4:13pm UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/7 "2021-01-26T16:13:08Z")
We've tried Filebaet but we've got the exact same issue. It does not write any logs although a manual index POST does work.. ---
**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\ **Post date:** [January 26, 2021, 4:36pm UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/8 "2021-01-26T16:36:44Z")
When you manually indexed the document, what index did it go into? (you should be able to see the concrete index name from the response JSON when indexing the document) ---
**Author:** ![Kevin\_Gonzalez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_gonzalez/32/83370_2.png) [@Kevin\_Gonzalez](https://discuss.elastic.co/u/Kevin_Gonzalez)\ **Post date:** [February 3, 2021, 2:33pm UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/9 "2021-02-03T14:33:03Z")
Hi @dakrone and @Zeroc0pter , I'm facing the same problem. Here's my scenario: 1. If I create the index from Serilog WITHOUT any ILM it works fine, I see all docs being logged. 2. If I create the index from Serilog WITH a ILM template, it doesn't log any docs to the index. It basically creates the index, apply the Lifecycle policy BUT doesn't add docs to the index. 3. If I create the index from a third party tool (Postman), with or without ILM, it works as expected. Have you found any solution? Thanks!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 3, 2021, 2:33pm UTC](https://discuss.elastic.co/t/recently-rolled-index-does-process-data-0-docs/261242/10 "2021-03-03T14:33:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.