PUT _ilm/policy/logstash_30days
{
"policy": {
"phases": {
"hot": {
"min_age" : "0ms",
"actions": {
"rollover": {
"max_size":"50gb",
"max_age":"30d"
},
"set_priority": {
"priority": 100
}
}
},
"warm": {
"actions": {
"shrink": {
"number_of_shards": 1
},
"set_priority": {
"priority": 50
}
}
},
"cold": {
"min_age": "0d",
"actions": {
"freeze": {},
"set_priority": {
"priority": 0
}
}
},
"delete": {
"min_age": "45d",
"actions": {
"delete": {
"delete_searchable_snapshot" : true
}
}
}
}
}
}
Template:
PUT _template/template_1
{
"index_pattern": ["logstash*"],
"settings":{
"number_of_shards" :1
"number_of_replicas" :1
"name:"logstash_30days"
"rollover_alias" : "logstash_rollover_alias"
}
}
PUT logstash-000001
{
"aliases":{
"logstash_rollover_alias":{
"is_write_index":true
}
}
}
Error:
https://discuss.elastic.co/t/index-lifecycle-rollover-alias-does-not-point-to-index