Using rollover indexes to reduce shard size?

Elastic Stack Elasticsearch
1

Hello

Ive been reading up on how to reduce my shard size as it seems my stack has that issue and Ive been reading about rollover indexes but I dont understand them too well....

I have one node.

Im gonna use some real life examples and such so bare with me.

say I have a index right now called

myindex-logons-2021.09

From what I understand, I would have to change that to a sort of "alias index" when my real index would be

myindex-logons-2021.09-001

After I would reach

myindex-logons-2021.09-002

and so on.

I understand that alias index would get the data from *-001 and *-002 but

1: How to I configure this? I imagine I have to use a ILM (I already have one) but Im not sure how to make it a number, make sure my "fake" index is the one I put

2: Deleting indexes; After x days, I would like to delete the "fake" myindex-logons-2021.09 which would force to delete the "real" indexes of myindex-logons-2021.09-001 and myindex-logons-2021.09-002

Is this how it works? Am I saying anything wrong?

2

Let's start by looking at your existing ILM policies, can you provide the output from GET _ilm/policy.

3

Sure.

This is what I currently have:

  "ilp-policy" : {
    "version" : 4,
    "modified_date" : "2021-09-01T09:06:02.218Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "210d",
          "actions" : { }
        }
      }
    }
  },

As you can see, currently after 210 days, the indexes get deleted; Im expermenting by changing the indexes to monthly to see if overtime the shard size gets reduced (I had it as daily logs)

4

Is that the only policy?

5

Yes it is

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.