Rolling-over with daily index using ILM policy

Elastic Stack Elasticsearch
1

Hi
We are in the process of creating an index template including ilm policy which has mentioned below.

                {
                "policy": {
                    "phases": {
                        "hot": {
                            "actions": {
                                "rollover": {
                                    "max_size": "10GB",
                                    "max_age": "1d"
                                }
                            }
                        },
                        "delete": {
                            "min_age": "7d",
                            "actions": {
                                "delete": {}
                            }
                        }
                    }
                }
            }

Expected use-case: We are expecting to rollover the created index daily, which means at the end of the day. At 12.00 am (0000h) we are expecting the new index to be created with the current date appended to the index name. So the name format we are expecting in indexes is my-log-yyyy-MM-dd. But the ILM policy we are currently having is not catering to the requirement. When we are bootstrapping the cluster, by giving the date patter it will result in a name like my-log-2020-06-18 as its name, but rolling over will happen with the appended number to that but not with the increased date. ie. my-log-2020-06-18-00001 to my-log-2020-06-18-00002. Please advise on this.

2

In order to have the name automatically updated, you need to make sure that the original index was created with date math, so for your latest index, if you retrieve the settings and look for the provided_name setting, you can see whether date math was used.

For the index, you need to use <my-log-{now/d}-000001> when you create it.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.