Answer the question
In order to leave comments, you need to log in
How does ILM work?
Good day! I must say right away that I did not work with elastic earlier. Please help me for this.
What do we have. Raised on the docker ELastic KIbana Logstash. On the host deployed, for testing, Nginx and filebeat. Filebeat throws logs into Logstash, which is in elastic. In elastic everything comes displayed and visible. I configured ILM configured the index template, but the documents do not decrease, if you set a size limit, the size decreases, but there are no docks. I still can’t understand how often ILM works for each index, once at the time specified in the policy, or according to the global timer, say once every 10 minutes? Or am I doing something wrong? My configs are below, all done via kibana.
right before publishing, I caught the error
index.lifecycle.rollover_alias [nginx-2021-*] does not point to index [nginx-2021-000001]
ILM policy
PUT _ilm/policy/nginx
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_size": "300mb",
"max_age": "30s"
},
"set_priority": {
"priority": 100
}
}
},
"delete": {
"min_age": "50s",
"actions": {
"delete": {
"delete_searchable_snapshot": true
}
}
}
}
}
}
PUT _index_template/nginx
{
"template": {
"settings": {
"index": {
"lifecycle": {
"name": "nginx",
"rollover_alias": "nginx-2021-*"
},
"number_of_shards": "1",
"number_of_replicas": "0"
}
},
"mappings": {
"_routing": {
"required": false
},
"numeric_detection": false,
"dynamic_date_formats": [
"strict_date_optional_time",
"yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"
],
"_source": {
"excludes": [],
"includes": [],
"enabled": true
},
"dynamic": true,
"dynamic_templates": [],
"date_detection": true
},
"aliases": {
"nginx": {}
}
},
"index_patterns": [
"nginx-2021-*"
],
"composed_of": []
}
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question