# Rollover for Daily indices in Elasticsearch

**URL:** <https://discuss.elastic.co/t/rollover-for-daily-indices-in-elasticsearch/324558>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [February 2, 2023, 2:22pm UTC](https://discuss.elastic.co/t/rollover-for-daily-indices-in-elasticsearch/324558 "2023-02-02T14:22:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Veysel\_yuksel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/veysel_yuksel/32/116690_2.png) [@Veysel\_yuksel](https://discuss.elastic.co/u/Veysel_yuksel)\
**Post date:** [February 2, 2023, 2:22pm UTC](https://discuss.elastic.co/t/rollover-for-daily-indices-in-elasticsearch/324558/1 "2023-02-02T14:22:15Z")

</div>

Hello,  
I am trying to implement rollover mechanism to my environments. Let me explain as is and to be design;  
Log data stores in syslog-%{+YYYY.MM.dd} indices right now. I keep data for 3 days. No rollover - No warm or cold phase. It is going to delete phase directly. So this is the as is design and I have  
syslog-2023-01-29  
syslog-2023-01-30  
syslog-2023-01-31

And I made some changes our ilm policy and apply rollover settings. It is running but there is a point;  
I need to separate index for everyday. So I added these ILM pattern settings in my logstash conf shown as below

```
            ilm_rollover_alias => "syslog"
            ilm_pattern => "{now/d}-000001"
            ilm_policy => "timeseries-syslog"

```

Result and Question;  
syslog-2023-02-01-000001 =\> it is ok  
syslog-2023-02-01-000002 =\> Why this pattern starts from 000002 ? How can I provide to start from 000001 when every new index created ? Is it normal behavior ?

Thank You

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 2, 2023, 2:36pm UTC](https://discuss.elastic.co/t/rollover-for-daily-indices-in-elasticsearch/324558/2 "2023-02-02T14:36:15Z")

</div>

The whole point of rollover is to allow new indices to be created based on age or size. This allows indices to cover a longer time period when data volumes are low and roll over more frequently during peak hours. This means that index creation will not align with specific points in time, e.g. change of date. These indices all have a suffix that will increment, which ensures a unique index name.

If you want to use rollover I would recommend not trying to control naming convention or exactly when rollover is performed. ILM will handle the lifecycle based on index metadata and not the name.

If you want indices to correspond to specific time periods, e.g. exactly a day per index, then do not use rollover and instead set the index name based on the event time as was commonly done before rollover became available.

---

<div class="post-metadata">

**Author:** ![Veysel\_yuksel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/veysel_yuksel/32/116690_2.png) [@Veysel\_yuksel](https://discuss.elastic.co/u/Veysel_yuksel)\
**Post date:** [February 2, 2023, 2:42pm UTC](https://discuss.elastic.co/t/rollover-for-daily-indices-in-elasticsearch/324558/3 "2023-02-02T14:42:25Z")

</div>

Thank You very much, Then I will merge them to one syslog index and I will use rollover.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2023, 2:43pm UTC](https://discuss.elastic.co/t/rollover-for-daily-indices-in-elasticsearch/324558/4 "2023-03-02T14:43:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.