Shard Size is 50gb

Elastic Stack Elasticsearch
1

I have an index called log-wlb-sysmon-2021.03.20-00002 and i am using ILM Policy for this index

{
  "winlogbeat_sysmon_policy" : {
    "version" : 8,
    "modified_date" : "2021-03-26T05:06:42.599Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "60d",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    }
  }
}

Now the index size is 58gb why it is not rollovering

health status index                            uuid                   pri rep docs.count docs.deleted store.size pri.store.size
 green  open   log-wlb-sysmon-2021.03.23-000002 EgDbcn3pSNWrR5noH3zvPQ   1   1   46159377        29088     59.1gb         29.4gb

Elasticsearch shard size should be 10 to 50gb according to this i have a confusion are they talking about primary shard or replica shard because in my case the actual index size is 29.4gb(primary shard) and total index with replication is 59.1gb

2

Rollover works on the total size of primary shards per index which in this case is just below 30GB.

3

so when we talking about that shard size should be 10 to 50gb...we are talking about primary shard or both (primary and replica shard)

4

We are talking about each individual primary shard. You can change the number of replica shards easily at runtime so if the rollover was based on this you could get quite unevenly sized primary shards. If you have an index with 2 primary shards setting the rollover target to 100GB would result in the 2 primary shards each being around 50GB.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.