Unable to define custom ILM phases

Elastic Stack Elasticsearch
1

I am interested in creating a custom phase. My request is as follows:

PUT _ilm/policy/test1
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "set_priority": {
            "priority": 100
          }
        }
      },
      "warm": {
        "min_age": "7d",
        "actions": {
          "allocate": {
            "require": {
              "box_type": "warm"
            }
          },
          "set_priority": {
            "priority": 50
          }
        }
      },
      "cold_my": {
        "min_age": "45d",
        "actions": {
         "allocate": {
            "require": {
              "box_type": "warm"
            }
          },
          "forcemerge": {
            "max_num_segments": "1"
          },
          "freeze": {},
          "set_priority": {
            "priority": 0
          }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

I am getting the following error:

{
  "error": {
    "root_cause": [
      {
        "type": "x_content_parse_exception",
        "reason": "Failed to build [lifecycle_policy] after last required field arrived"
      }
    ],
    "type": "x_content_parse_exception",
    "reason": "[48:5] [put_lifecycle_request] failed to parse field [policy]",
    "caused_by": {
      "type": "x_content_parse_exception",
      "reason": "[48:5] [lifecycle_policy] failed to parse field [phases]",
      "caused_by": {
        "type": "x_content_parse_exception",
        "reason": "Failed to build [lifecycle_policy] after last required field arrived",
        "caused_by": {
          "type": "illegal_argument_exception",
          "reason": "Timeseries lifecycle does not support phase [cold_my]"
        }
      }
    }
  },
  "status": 400
}

I am not sure why it is called timeseries lifecycle and what other lifecycle options are available. How can I define a custom phase?

2

The phases of an index in the context of ILM are detailed here.

The allowed actions per-phase can be found here.

There is no capability to create a custom phase for ILM.

Perhaps you can describe your scenario and the reason(s) that what you need to accomplish can't be done with those constraints?

1 Like
3

@Glen_Smith I would like to know the reasoning behind allowing actions in specific phases only?

My scenario is as follows:

  • hot phase: bulk of the indexing load will come to this phase
  • warm phase: after a few days, indices will be moved to older hardware but late order events will be allowed so can't apply force merge
  • warm-cold intermediary phase: force merge can be applied
  • cold phase: freeze indices
  • delete: terminal phase
4

I see.

Here is how I would proceed.

In the github repository for Elasticsearch, submit a new feature request issue.
As I see it, the need here is to clearly distinguish between indices receiving heavy indexing and those getting occasional indexing, and to have the ability to perform an allocation action at the transition between those two stages, while preserving the ability to perform a force merge when the index will no longer be indexed at all.

Such a proposal, if accepted, will take some time to be prioritized, implemented, and released - probably longer than you will want to wait to address the situation in your cluster(s).

So, in the meantime, I would recommend investigating Curator to trigger index actions outside of ILM. Basically, this involves installing Curator on a host with access to the cluster, providing it with a configuration for the actions you need, and running a cron job.

With the way you describe the phases, you would let ILM execute the transition from hot to warm, with e.g. the allocation action, and then have Curator apply a force merge and update the index configuration to read_only when your criteria are met for that stage, leaving ILM to pick back up at the transition from warm to cold.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.