ILM using Logstash Elasticsearch output plugin doesn't work

Question

I'm trying to implement ILM for an index to properly use hardware, using the Elasticsearch output plugin. Looks like I misunderstand how Logstash manages ILM.

I have ELK stack version 7.1.0 in docker. X-Pack is activated by trial license.

The index template is managed by Logstash Elasticsearch output plugin and the index lifecycle policy was created using Kibana.

Here is the output section of Logstash pipeline:

output {
    elasticsearch {
        hosts => ["http://eshost:9200"]
        user => "logstash_writer"
        password => "pass"
        template => "/usr/share/logstash/es_templates/ilm-template.json"
        template_name => "ilm-template"
        template_overwrite => true
        ilm_enabled => true
        ilm_rollover_alias => "ilm-index"
        ilm_pattern => "000001"
        ilm_policy => "base-policy"
    }
}

User logstash_writer has default role logstash_writer with permissions for ILM management.

Elasticsearch index template ilm-template.json:

{
  "settings" : {
    "index.number_of_replicas" : "1",
    "index.number_of_shards" : "1",
    "index.refresh_interval" : "5s"
  }
}

Elasticsearch index template _template/ilm-template that was actually created by Logstash:

{
  "ilm-template" : {
    "order" : 0,
    "index_patterns" : [
      "ilm-index-*"
    ],
    "settings" : {
      "index" : {
        "lifecycle" : {
          "name" : "base-policy",
          "rollover_alias" : "ilm-index"
        },
        "refresh_interval" : "5s",
        "number_of_shards" : "1",
        "number_of_replicas" : "1"
      }
    },
    "mappings" : { },
    "aliases" : { }
  }
}

Policy base-policy created using Kibana:

{
    "policy": {
        "phases": {
            "hot": {
                "min_age": "0ms",
                "actions": {
                    "rollover": {
                        "max_size": "100mb",
                        "max_docs": 100000
                    },
                    "set_priority": {
                        "priority": 100
                    }
                }
            },
            "delete": {
                "min_age": "2d",
                "actions": {
                    "delete": {}
                }
            }
        }
    }
}

I expect the set of indices ilm-index-*, but only ilm-index-000001 is created and constantly growing, despite the limitations of base-policy. So I only see in Kibana one index (ilm-index-000001) associated with base-policy.

Alexander Bolshakov Alexander Bolshakov · Accepted Answer · 2019-06-13T14:35:58

The provided configuration is correct. The problem is in interpretation of max_size and max_docs parameters when they have small value. Elasticsearch doesn't rollover indices when it's pri.store.size and docs.count become larger than set in max_size and max_docs.

ILM using Logstash Elasticsearch output plugin doesn't work

1 Answers