CODEWITHSUNDEEP
elasticsearchelastic-stackelk
abdelhalim
abdelhalim

Reputation: 195

Elasticsearch ILM not rolling

I have configured my ILM to rollover when the indice size be 20GB or after passing 30 days in the hot node

enter image description here

but my indice passed 20GB and still didn't pass to the cold node

enter image description here

and when I run: GET _cat/indices?v I get:

green  open   packetbeat-7.9.2-2020.10.22-000001                         RRAnRZrrRZiihscJ3bymig  10   1   63833049            0     44.1gb           22gb

Could you tell me how to solve that please !

Knowing that in my packetbeat file configuration, I have just changed the number of shards:

setup.template.settings:
  index.number_of_shards: 10
  index.number_of_replicas: 1

when I run the command GET packetbeat-7.9.2-2020.10.22-000001/_settings I get this output:

{
  "packetbeat-7.9.2-2020.10.22-000001" : {
    "settings" : {
      "index" : {
        "lifecycle" : {
          "name" : "packetbeat",
          "rollover_alias" : "packetbeat-7.9.2"
        },
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        },
        "mapping" : {
          "total_fields" : {
            "limit" : "10000"
          }
        },
        "refresh_interval" : "5s",
        "number_of_shards" : "10",
        "provided_name" : "<packetbeat-7.9.2-{now/d}-000001>",
        "max_docvalue_fields_search" : "200",
        "query" : {
          "default_field" : [
            "message",
            "tags",
            "agent.ephemeral_id",
            "agent.id",
            "agent.name",
            "agent.type",
            "agent.version",
            "as.organization.name",
            "client.address",
            "client.as.organization.name",

and the output of the command GET /packetbeat-7.9.2-2020.10.22-000001/_ilm/explain is :

{
  "indices" : {
    "packetbeat-7.9.2-2020.10.22-000001" : {
      "index" : "packetbeat-7.9.2-2020.10.22-000001",
      "managed" : true,
      "policy" : "packetbeat",
      "lifecycle_date_millis" : 1603359683835,
      "age" : "15.04d",
      "phase" : "hot",
      "phase_time_millis" : 1603359684332,
      "action" : "rollover",
      "action_time_millis" : 1603360173138,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1603360173138,
      "phase_execution" : {
        "policy" : "packetbeat",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "version" : 1,
        "modified_date_in_millis" : 1603359683339
      }
    }
  }
}

It's weird that it's 50GB !!

Thanks for your help

Upvotes: 2

Views: 2546

Answers (1)

abdelhalim
abdelhalim

Reputation: 195

So I found the solution of this problem. After updating the policy, I removed the policy from the index using it, and then added it again to those index.

Upvotes: 3

Related Questions