When do the delete happen in the lifecycle policy

Elastic Stack Kibana
1

Hello all,

I'm having a hard time finding a clear answer about this, sorry if it was already answered elsewhere:

I have an index lifecycle policy setup to rollover the hot phase with a max age of 7 days.
There are no intermediate phases between Hot and Delete.
The delete phase is setup to move data into phase when 7 days old.

Let's say i first write data on the 1st day at 00h00.
On the 8th day at 00h00 a new index will be created and the new data written on it following the rollover policy.
Some data was written on the 7th day at 23h59.

Will it delete the old index instantly since the first data is 7 days old?
Or will it wait for the last data written on the index to reach 7 days old?

In the first case the last data would have lived 1 minute which is not what i am after.

Thanks!

2

Not instantly as the ILM actions run on an schedule of 10 minutes per default, so the first action would be to rollover the index, then the next action would be to delete the index.

No, the ILM actions are based on the index creation date, if an index was created 7 days ago it doesn't matter if the last document was indexed 5 seconds ago, the entire index will be deleted.

If you want a document to be available for 7 days and you have a rollover of 7 days, your delete phase needs to happen after 14 days.

3

Alright, thank you very much!

In my case 10 minutes or instantly is the same but I understand the need to clarify that.