Why aren't my indexes being managed by ILM?

Elastic Stack Elasticsearch
1

I have an index for packetbeat. Needless to say, this pulls down lots of data so Im wanting to

a) roll it over often
b) delete it after 12 hours

It isn't doing either activity and Im struggling to understand why.

GET packetbeat-000003/_ilm/explain
{
  "indices" : {
    "packetbeat-000003" : {
      "index" : "packetbeat-000003",
      "managed" : true,
      "policy" : "packetbeat-rollover"
    }
  }
}

GET _ilm/policy
"packetbeat-rollover" : {
    "version" : 2,
    "modified_date" : "2019-11-05T11:55:49.497Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "20gb",
              "max_age" : "3h"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "12h",
          "actions" : {
            "delete" : { }
          }
        }
      }
    }
  },

Im able to make it rollover via curl but that's not the desired process.

Any idea how to make this work?

2

Hi ethrbunny,

What version of ES are you running? If you do a:

POST /<index>/_ilm/remove

And then:

PUT /<index>/_settings
{
  "index.lifecycle.name": "packetbeat-rollover"
}

Does the ILM explain output change at all?

3

After deleting / rebuilding this index multiple times I think its working. It's fussy about the order of events (index, template, ILM, etc)

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.