[Solved] Default refresh interval being ignored

[thecosmicfrog]

Hi there,

I would like to increase the refresh interval for all future indices to 30s.

To do this, I've set the following config (on all nodes) in elasticsearch.yml and restarted:

# Increase refresh interval.
 index.refresh_interval: 30s

However, it seems that whenever Logstash creates an index in Elasticsearch, it sets the refresh interval for that index to 5s, as below:

$ curl http://ES_HOST:PORT/logstash-2017.02.16.11?pretty

[...]
"settings" : {
  "index" : {
    "creation_date" : "1487242800240",
    "refresh_interval" : "5s",
    "number_of_shards" : "5",
    "number_of_replicas" : "1",
    "uuid" : "abc123",
    "version" : {
      "created" : "2040499"
    }
  }
},
[...]

I'm not sure if this is an issue with my Elasticsearch configuration, or Logstash simply overriding the default set by the Elasticsearch nodes.

I'd appreciate any advice or help with this issue. Many thanks!

[danielmitterdorfer]

Hi @thecosmicfrog,

I guess you are on an older version of Elasticsearch like 1.x or 2.x as you've defined this setting in elasticsearch.yml. I recommend you define this setting with an index template instead:

PUT /_template/my_default_template
{
  "template": "*",
  "settings": {
    "refresh_interval": "30s"
  }
}

Note: This will also simplify upgrading as Elasticsearch 5 does not allow you anymore to define index settings in elasticsearch.yml.

It's hard to tell why the refresh interval is 5s though. The most likely cause is that you already have an index template that overrides your setting. Just issue GET /_template to see a list of all your index templates and see if you can find it that way.

Daniel

[thecosmicfrog]

Hi @danielmitterdorfer,

Yes, that's correct. I'm currently on version 2.4.4 - I should have included this in the OP - apologies!

Fantastic! That solved my issue completely. There was indeed a default template for Logstash which enforced a refresh_interval of 5s. I deleted it and created a new template per your suggestion above. The refresh interval is now correct at 30s.

Thank you so much for your assistance!

All the best,
Aaron

[danielmitterdorfer]

Hi Aaron,

you're welcome. I am glad it works now!

Daniel