# When do delete policies in ILM actually get applied?

**URL:** https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563
**Category:** Elasticsearch
**Tags:** ilm-index-lifecycle-management
**Created:** [November 30, 2021, 2:36pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563 "2021-11-30T14:36:33Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)
#### Post date: [November 30, 2021, 2:36pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563/1 "2021-11-30T14:36:33Z")

</div>

Hello

We have a ILM policy that deletes logs older than 240 days.

We also have a monitoring system that watches the mount point where the logs get stored for space.

Every 1-2 months, we get a alert that it gets near its threshold but randomly the next hours/days , it gets away from it but then meets it again. We imagine this is happening because it gets filled up, the ILM policy kicks in clearing logs but then in x timeframe, logs keep coming in and it fills up again.

I would like to be able to explain how the arch works when it comes to ILM and deleting: What process runs in this policy? Is it EXACTLY 240 days or is there a "refresh period" to where it looks at the policy THEN applies it? etc

Thank you

---

<div class="post-metadata">

### Author: ![DineshNaik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dineshnaik/32/89308_2.png) [@DineshNaik](https://discuss.elastic.co/u/DineshNaik)
#### Post date: [November 30, 2021, 5:32pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563/2 "2021-11-30T17:32:31Z")

</div>

@riahc3 You need to check the policy details defined in your setup , if its default or changed as per your use case.

To view the `logs` policy in Kibana:

1. Open the menu and go to **Stack Management \> Index Lifecycle Policies**.
2. Select the `logs` policy.

The `logs` policy uses the recommended rollover defaults: Start writing to a new index when the current write index reaches 50GB or becomes 30 days old.

Refer [page](https://www.elastic.co/guide/en/elasticsearch/reference/current/example-using-index-lifecycle-policy.html) for more details on the same.

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 30, 2021, 5:46pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563/3 "2021-11-30T17:46:24Z")

</div>

According to the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-settings.html#_cluster_level_settings) the ILM checks for indices that match any of the conditions every 10 minutes.

What does your policy looks like? Are you deleting only by time? Please, share it.

---

<div class="post-metadata">

### Author: ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)
#### Post date: [December 1, 2021, 1:55pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563/4 "2021-12-01T13:55:32Z")

</div>

```auto
{
  "logs-ilp" : {
    "version" : 4,
    "modified_date" : "2021-09-01T09:06:02.218Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "210d",
          "actions" : { }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

### Author: ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)
#### Post date: [December 1, 2021, 1:56pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563/5 "2021-12-01T13:56:02Z")

</div>

That would be the policy @leandrojmp

---

<div class="post-metadata">

### Author: ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)
#### Post date: [December 1, 2021, 1:56pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563/6 "2021-12-01T13:56:27Z")

</div>

Yes, I am currently using a custom made policy for my logs.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 29, 2021, 1:57pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563/7 "2021-12-29T13:57:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
