# Using rollover indexes to reduce shard size?

**URL:** <https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [September 2, 2021, 4:05pm UTC](https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196 "2021-09-02T16:05:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [September 2, 2021, 4:05pm UTC](https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196/1 "2021-09-02T16:05:38Z")

</div>

Hello

Ive been reading up on how to reduce my shard size as it seems my stack has that issue and Ive been reading about rollover indexes but I dont understand them too well....

I have one node.

Im gonna use some real life examples and such so bare with me.

say I have a index right now called

myindex-logons-2021.09

From what I understand, I would have to change that to a sort of "alias index" when my real index would be

myindex-logons-2021.09-001

After I would reach

myindex-logons-2021.09-002

and so on.

I understand that alias index would get the data from \*-001 and \*-002 but

1: How to I configure this? I imagine I have to use a ILM (I already have one) but Im not sure how to make it a number, make sure my "fake" index is the one I put

2: Deleting indexes; After x days, I would like to delete the "fake" myindex-logons-2021.09 which would force to delete the "real" indexes of myindex-logons-2021.09-001 and myindex-logons-2021.09-002

Is this how it works? Am I saying anything wrong?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 3, 2021, 12:25am UTC](https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196/2 "2021-09-03T00:25:19Z")

</div>

Let's start by looking at your existing ILM policies, can you provide the output from `GET _ilm/policy`.

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [September 3, 2021, 6:42am UTC](https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196/3 "2021-09-03T06:42:14Z")

</div>

Sure.

This is what I currently have:

```auto
  "ilp-policy" : {
    "version" : 4,
    "modified_date" : "2021-09-01T09:06:02.218Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "210d",
          "actions" : { }
        }
      }
    }
  },

```

As you can see, currently after 210 days, the indexes get deleted; Im expermenting by changing the indexes to monthly to see if overtime the shard size gets reduced (I had it as daily logs)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 3, 2021, 8:18am UTC](https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196/4 "2021-09-03T08:18:35Z")

</div>

Is that the only policy?

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [September 3, 2021, 8:19am UTC](https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196/5 "2021-09-03T08:19:27Z")

</div>

Yes it is

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2021, 8:20am UTC](https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196/6 "2021-10-01T08:20:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.