Rollover ILM policy for existing Index

Elastic Stack Logstash
1

Hi Can anyone help me on Rollover ILM for existing index , which needs to be rolled over on reaching certain age/ gb. Thankyou in advance.

2

Welcome to our community! :smiley:

Have you seen Manage existing indices | Elasticsearch Guide [7.16] | Elastic? Have you tried anything in it if you have? If so what config did you use? What's not working how you expect?

3

Yes tried with alias.. but getting the error. Alias index not pointing to the index, Getting the new index created .. but not pulling the logs.. and the existing index is growing on which I’m supposed to apply the rollover policy

4

It'd be useful if you shared the policy you created as well as other commands and errors you run/see when you are applying it.

5 
PUT _ilm/policy/logstash_30days

{
"policy": {
"phases": {
"hot": {
"min_age" : "0ms",
"actions": {
"rollover": {
"max_size":"50gb",
"max_age":"30d"
},
"set_priority": {
"priority": 100
}
}
},
"warm": {

    "actions": {
      
      
      "shrink": {
        "number_of_shards": 1
      },
                
      "set_priority": {
        "priority": 50
      }
    }
  },
  "cold": {
    "min_age": "0d",
    "actions": {
     "freeze": {},
     "set_priority": {
        "priority": 0
      }

    }
  },
  "delete": {
    "min_age": "45d",
    "actions": {
      "delete": {
       "delete_searchable_snapshot" : true

}
}
}
}
}
}

Template:

PUT _template/template_1
{
"index_pattern": ["logstash*"],
"settings":{
"number_of_shards" :1
"number_of_replicas" :1
"name:"logstash_30days"
"rollover_alias" : "logstash_rollover_alias"
}
}

PUT logstash-000001
{
"aliases":{
"logstash_rollover_alias":{
"is_write_index":true
}
}
}

Error:
https://discuss.elastic.co/t/index-lifecycle-rollover-alias-does-not-point-to-index

6

Can we apply rollover ilm policy to the existing index which is already huge like 90gb.. what could be the best approach please.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.