Delete old indices automatically

hi all,
trying to find out best way of deleting old indices automatically. couldn’t manage with that rollover example of OSearch document. This one is working but just want to make sure if this is a correct or any objection of using this way. thanks in advance.

{
    "id": "yy-visualpolicy",
    "seqNo": 89895,
    "primaryTerm": 1,
    "policy": {
        "policy_id": "yy-visualpolicy",
        "description": "yy-test-policy",
        "last_updated_time": 1644237141373,
        "schema_version": 12,
        "error_notification": null,
        "default_state": "hot",
        "states": [
            {
                "name": "hot",
                "actions": [],
                "transitions": [
                    {
                        "state_name": "yy-delete",
                        "conditions": {
                            "min_index_age": "3h"
                        }
                    }
                ]
            },
            {
                "name": "yy-delete",
                "actions": [
                    {
                        "delete": {}
                    }
                ],
                "transitions": []
            }
        ],
        "ism_template": [
            {
                "index_patterns": [
                    "exampleindex*"
                ],
                "priority": 1,
                "last_updated_time": 1644231879662
            }
        ]
    }
}
1 Like

In your example it will moves indices to the yy-delete state after the index is ~3h old and then delete them. If that’s what you want then that is perfectly fine.

Some potential additions you might want to consider:

  1. Add some retries to the delete action, in case there is some transient failure when trying to delete then at least it’ll retry a few times (however many you specify).
  2. Take advantage of the error_notification feature so you can get notified if the index fails to transition or delete for whatever reason. As having indices pile up eventually leading to the cluster running out of space is possible if the deletions are always failing or ISM is failing to transition the index.
2 Likes