Hi, I am trying to setup an ilm policy for the index. I created the policy and attached it to the template. Used the same template in the logstash output. But I don't see the rollover happening.
For testing purpose I have set max_size
to 5mb
but size I see in Kibana dev when I query ES is around 13mb
already. Can someone please suggest what else I am missing to make this work?
Policy (name: ecom_ilm_policy)
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "1d",
"max_size": "5mb"
},
"set_priority": {
"priority": null
}
}
},
"warm": {
"min_age": "4d",
"actions": {
"set_priority": {
"priority": null
}
}
},
"cold": {
"min_age": "7d",
"actions": {
"set_priority": {
"priority": null
}
}
},
"delete": {
"min_age": "8d",
"actions": {
"delete": {}
}
}
}
}
}
My index template:
{
"index_patterns": ["ecom-*"],
"template": {
"settings": {
"number_of_shards": 1,
"index.lifecycle.name": "ecom_ilm_policy",
"index.lifecycle.rollover_alias":"ecom"
},
"mappings": {
"properties": {
"timestamp": {
"type": "date"
},
"level": {
"type": "keyword"
},
"mdc.audit_id": {
"type": "text",
"index": false
},
"mdc.status": {
"type": "keyword"
},
"mdc.instance_id": {
"type": "text",
"index": false
},
"mdc.url": {
"type": "text"
},
"mdc.executionTime": {
"type": "integer"
},
"thread": {
"type": "keyword",
"index": false
},
"logger": {
"type": "text",
"index": false
},
"message": {
"type": "keyword"
},
"exception": {
"type": "text"
}
}
}
},
"priority": 51,
"version": 1,
"_meta": {
"description": "my custom"
}
}
Bootstrap the index with a write alias after creating the index template.
/ecom-000001
{
"aliases": {
"ecom": {
"is_write_index": true
}
}
}
Logstash Config:
input {
redis {
host => "172.17.0.2"
key => "ecom"
data_type => "list"
}
}
output {
if "ecom_app" in [tags]{
elasticsearch {
hosts => ["eslocalhost:9200"]
index => "ecom-app-logs"
# manage_template => true
# template_name => "ecom_template"
ilm_enabled => true
}
}
}