Rollover api : How to Run it 30 min wise

Elastic Stack Elasticsearch
#1

Suppose I do :

POST /indexname/_rollover
{
"conditions": {
"max_age": "30m",
"max_docs": 1000,
"max_size": "5gb"
}
}

Will it work?

If not what is the correct way of generating indices every 30 mins.

#2

{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"source alias is a concrete index"}],"type":"illegal_argument_exception","reason":"source alias is a concrete index"},"status":400}

I am getting the above error. Where am I going wrong?

#3

Hello.

For the roll over api, I have done the following but I got an error

POST /_aliases
{
"actions" : [
{ "add" : { "index" : "netflow-2018.08.10", "alias" : "netflow-2018.08.10_630" } }
]
}

POST /netflow-2018.08.10_630/_rollover
{
"conditions": {
"max_age": "30m",
"max_docs": 1000,
"max_size": "5gb"
}
}

I did this.

But the error I got was:

{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "index name [netflow-2018.08.10] does not match pattern '^.-\d+$'"
}
],
"type": "illegal_argument_exception",
"reason": "index name [netflow-2018.08.10] does not match pattern '^.-\d+$'"
},
"status": 400

#4

First, the error you are getting is because the index name must end with a numeric pattern. For instance, an index name named after index-0001. In your case, the index name is netflow-2018.08.10, which does not follows that pattern.

Secondly, when you are using the rollover API you probably don't want to use an index name that carries a timestamp, so instead of netflow-2018.08.10you would have netflow-000001 as na index name. There is a possibility of using timestamp combined with rollover API as well, read more about it here: https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-rollover-index.html#_using_date_math_with_the_rollover_api

There is also a very good article about rollover here: https://www.elastic.co/blog/managing-time-based-indices-efficiently

#5

Thanks Thiago! I will give the date wise indices roll over a try. My whole design is date dependent.

1 Like
#6

Hello can anyone make me understand this regular expression for roll over api:

PUT /<logs-{now/d}-1> with URI encoding:

PUT /%3Clogs-%7Bnow%2Fd%7D-1%3E

Now if I want to have netflow indices of format netflow-2018.08.10 rolled over, what do I do?

From theory, I was told that roll over api works with the format of having it ended with an integer -1 like netflow-2018.08.10-1 and then make an alias. The alias will be rolled over.

However this thing is not working and I am really struck on what to do next.

#7

Try exactly as described here https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-rollover-index.html#_using_date_math_with_the_rollover_api until you can make it work, then adapt to your case.

#8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.