Rollover is taking time

Elastic Stack Elasticsearch
1

My Policy is supposed to roll over indices if size reaches to 500mb like below:

GET _ilm/policy/my-policy
{
  "my-policy" : {
    "version" : 4,
    "modified_date" : "2021-03-31T14:34:45.932Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "500mb",
              "max_age" : "1h"
            }
          }
        },
        "delete" : {
          "min_age" : "1h",
          "actions" : {
            "delete" : { }
          }
        }
      }
    }
  }
}

But observed indices are rolling over after reaching over 2GB.

Whats wrong with my config?

2

Hi Narayan,

There's an interval of 10 minutes that rollover will happen

indices.lifecycle.poll_interval
(Dynamic, time unit value) How often index lifecycle management checks for indices that meet policy criteria. Defaults to 10m .

Rollover will only run after every interval, if within the interval your logs keeps coming in, it will still store at the previous even after the policy hits.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.