Rollup job or transform size of resulting indices - lifecycle?

Elastic Stack Kibana
,
1

Do Rollup jobs ever reduce in size on their own? I couldn't find a way to add the index created by a rollup job to a lifecycle policy. The rollup job never seemed to reduce in size so I turned the job off.

Need case: we have many watchers routinely query an existing index, making multiple aggregations before processing them, looking for actions to do on their results. We're trying to create a rollup job do the aggregations and have the watchers query the resulting rollup index (it will be much less watchers needed if we can do this).

Should we be using transforms instead?

2

You'd need to create an ILM policy for them, I don't believe they are currently, automatically created with one for you.

3

Elasticsearch didn't allow me to create an ILM policy for that index (I've made them for all the rest of our indices). There's something about a rollup index that doesn't permit a life cycle for some reason. This is why I was thinking maybe Elasticsearch maintained a retention on rollups internally? Maybe the latency value means something for this?