Elasticsearch ILM not rolling

Question

I have configured my ILM to rollover when the indice size be 20GB or after passing 30 days in the hot node

but my indice passed 20GB and still didn't pass to the cold node

and when I run: GET _cat/indices?v I get:

green  open   packetbeat-7.9.2-2020.10.22-000001                         RRAnRZrrRZiihscJ3bymig  10   1   63833049            0     44.1gb           22gb

Could you tell me how to solve that please !

Knowing that in my packetbeat file configuration, I have just changed the number of shards:

setup.template.settings:
  index.number_of_shards: 10
  index.number_of_replicas: 1

when I run the command GET packetbeat-7.9.2-2020.10.22-000001/_settings I get this output:

{
  "packetbeat-7.9.2-2020.10.22-000001" : {
    "settings" : {
      "index" : {
        "lifecycle" : {
          "name" : "packetbeat",
          "rollover_alias" : "packetbeat-7.9.2"
        },
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        },
        "mapping" : {
          "total_fields" : {
            "limit" : "10000"
          }
        },
        "refresh_interval" : "5s",
        "number_of_shards" : "10",
        "provided_name" : "<packetbeat-7.9.2-{now/d}-000001>",
        "max_docvalue_fields_search" : "200",
        "query" : {
          "default_field" : [
            "message",
            "tags",
            "agent.ephemeral_id",
            "agent.id",
            "agent.name",
            "agent.type",
            "agent.version",
            "as.organization.name",
            "client.address",
            "client.as.organization.name",

and the output of the command GET /packetbeat-7.9.2-2020.10.22-000001/_ilm/explain is :

{
  "indices" : {
    "packetbeat-7.9.2-2020.10.22-000001" : {
      "index" : "packetbeat-7.9.2-2020.10.22-000001",
      "managed" : true,
      "policy" : "packetbeat",
      "lifecycle_date_millis" : 1603359683835,
      "age" : "15.04d",
      "phase" : "hot",
      "phase_time_millis" : 1603359684332,
      "action" : "rollover",
      "action_time_millis" : 1603360173138,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1603360173138,
      "phase_execution" : {
        "policy" : "packetbeat",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "version" : 1,
        "modified_date_in_millis" : 1603359683339
      }
    }
  }
}

It's weird that it's 50GB !!

Thanks for your help

Can you show the settings of your index? GET packetbeat-7.9.2-2020.10.22-000001/_settings ? — Val
when I run that command I get : ``` { "packetbeat-7.9.2-2020.10.22-000001" : { "settings" : { "index" : { "lifecycle" : { "name" : "packetbeat", "rollover_alias" : "packetbeat-7.9.2" }, "routing" : { "allocation" : { "include" : { "_tier_preference" : "data_content" } } }, "mapping" : { "total_fields" : { "limit" : "10000" } }, "refresh_interval" : "5s", "number_of_shards" : "10", ``` — abdelhalim

abdelhalim abdelhalim · Accepted Answer · 2020-11-30T15:40:33

So I found the solution of this problem. After updating the policy, I removed the policy from the index using it, and then added it again to those index.

Elasticsearch ILM not rolling

1 Answers