# Rollover api : How to Run it 30 min wise

**URL:** https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318
**Category:** Elasticsearch
**Created:** [August 7, 2018, 12:09pm UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318 "2018-08-07T12:09:28Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![BoffinPanda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boffinpanda/32/26225_2.png) [@BoffinPanda](https://discuss.elastic.co/u/BoffinPanda)
#### Post date: [August 7, 2018, 12:09pm UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318/1 "2018-08-07T12:09:28Z")

</div>

Suppose I do :

POST /indexname/\_rollover  
{  
"conditions": {  
"max\_age": "30m",  
"max\_docs": 1000,  
"max\_size": "5gb"  
}  
}

Will it work?

If not what is the correct way of generating indices every 30 mins.

---

<div class="post-metadata">

### Author: ![BoffinPanda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boffinpanda/32/26225_2.png) [@BoffinPanda](https://discuss.elastic.co/u/BoffinPanda)
#### Post date: [August 10, 2018, 12:45pm UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318/2 "2018-08-10T12:45:27Z")

</div>

> [@BoffinPanda](#):
>
> POST /indexname/\_rollover  
> {  
> "conditions": {  
> "max\_age": "30m",  
> "max\_docs": 1000,  
> "max\_size": "5gb"  
> }  
> }

{"error":{"root\_cause":[{"type":"illegal\_argument\_exception","reason":"source alias is a concrete index"}],"type":"illegal\_argument\_exception","reason":"source alias is a concrete index"},"status":400}

I am getting the above error. Where am I going wrong?

---

<div class="post-metadata">

### Author: ![BoffinPanda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boffinpanda/32/26225_2.png) [@BoffinPanda](https://discuss.elastic.co/u/BoffinPanda)
#### Post date: [August 10, 2018, 2:21pm UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318/3 "2018-08-10T14:21:38Z")

</div>

Hello.

For the roll over api, I have done the following but I got an error

POST /\_aliases  
{  
"actions" : [  
{ "add" : { "index" : "netflow-2018.08.10", "alias" : "netflow-2018.08.10\_630" } }  
]  
}

POST /netflow-2018.08.10\_630/\_rollover  
{  
"conditions": {  
"max\_age": "30m",  
"max\_docs": 1000,  
"max\_size": "5gb"  
}  
}

I did this.

But the error I got was:

{  
"error": {  
"root\_cause": [  
{  
"type": "illegal\_argument\_exception",  
"reason": "index name [netflow-2018.08.10] does not match pattern '^._-\d+$'"  
}  
],  
"type": "illegal\_argument\_exception",  
"reason": "index name [netflow-2018.08.10] does not match pattern '^._-\d+$'"  
},  
"status": 400

---

<div class="post-metadata">

### Author: ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [August 10, 2018, 3:06pm UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318/4 "2018-08-10T15:06:46Z")

</div>

First, the error you are getting is because the _index name_ must end with a numeric pattern. For instance, an index name named after `index-0001`. In your case, the index name is `netflow-2018.08.10`, which does not follows that pattern.

Secondly, when you are using the rollover API you probably don't want to use an index name that carries a timestamp, so instead of `netflow-2018.08.10`you would have `netflow-000001` as na index name. There is a possibility of using timestamp combined with rollover API as well, read more about it here: [https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-rollover-index.html#\_using\_date\_math\_with\_the\_rollover\_api](https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-rollover-index.html#_using_date_math_with_the_rollover_api)

There is also a very good article about rollover here: [https://www.elastic.co/blog/managing-time-based-indices-efficiently](https://www.elastic.co/blog/managing-time-based-indices-efficiently)

---

<div class="post-metadata">

### Author: ![BoffinPanda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boffinpanda/32/26225_2.png) [@BoffinPanda](https://discuss.elastic.co/u/BoffinPanda)
#### Post date: [August 10, 2018, 3:15pm UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318/5 "2018-08-10T15:15:32Z")

</div>

Thanks Thiago! I will give the date wise indices roll over a try. My whole design is date dependent.

---

<div class="post-metadata">

### Author: ![BoffinPanda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boffinpanda/32/26225_2.png) [@BoffinPanda](https://discuss.elastic.co/u/BoffinPanda)
#### Post date: [August 11, 2018, 2:16am UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318/6 "2018-08-11T02:16:57Z")

</div>

Hello can anyone make me understand this regular expression for roll over api:

# PUT /\<logs-{now/d}-1\> with URI encoding:

PUT /%3Clogs-%7Bnow%2Fd%7D-1%3E

Now if I want to have netflow indices of format netflow-2018.08.10 rolled over, what do I do?

From theory, I was told that roll over api works with the format of having it ended with an integer -1 like netflow-2018.08.10-1 and then make an alias. The alias will be rolled over.

However this thing is not working and I am really struck on what to do next.

---

<div class="post-metadata">

### Author: ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [August 11, 2018, 3:09am UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318/7 "2018-08-11T03:09:01Z")

</div>

Try exactly as described here [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-rollover-index.html#\_using\_date\_math\_with\_the\_rollover\_api](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-rollover-index.html#_using_date_math_with_the_rollover_api) until you can make it work, then adapt to your case.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 8, 2018, 3:09am UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318/8 "2018-09-08T03:09:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
