help, my policy is:
View JSON of policy_1
{
"id": "policy_1",
"seqNo": 48500,
"primaryTerm": 4,
"policy": {
"policy_id": "policy_1",
"description": "ingesting logs",
"last_updated_time": 1689893403702,
"schema_version": 18,
"error_notification": null,
"default_state": "ingest",
"states": [
{
"name": "ingest",
"actions": [
{
"retry": {
"count": 3,
"backoff": "exponential",
"delay": "1m"
},
"rollover": {
"min_doc_count": 5
}
}
],
"transitions": [
{
"state_name": "search"
}
]
},
{
"name": "search",
"actions": [],
"transitions": [
{
"state_name": "delete",
"conditions": {
"min_index_age": "1d"
}
}
]
},
{
"name": "delete",
"actions": [
{
"retry": {
"count": 3,
"backoff": "exponential",
"delay": "1m"
},
"delete": {}
}
],
"transitions": []
}
],
"ism_template": null
}
}
You can check the index with that policy attached to see whether it has an alias or it’s the write index of its alias or not.
run the following line:
GET _plugins/_ism/explain/security-auditlog-2023.07.19
and he answers me the following:
{
“security-auditlog-2023.07.19”: {
“index.plugins.index_state_management.policy_id”: “policy_1”,
“index.opendistro.index_state_management.policy_id”: “policy_1”,
“index”: “security-auditlog-2023.07.19”,
“index_uuid”: “pkhgJTfvT0Wi6sXVeaiLbA”,
“policy_id”: “policy_1”,
“policy_seq_no”: 48500,
“policy_primary_term”: 4,
“rolled_over”: false,
“index_creation_date”: 1689724817961,
“state”: {
“name”: “ingest”,
“start_time”: 1689968863758
},
“action”: {
“name”: “rollover”,
“start_time”: 1689974615594,
“index”: 0,
“failed”: true,
“consumed_retries”: 3,
“last_retry_time”: 1689975288538
},
“step”: {
“name”: “attempt_rollover”,
“start_time”: 1689974615594,
“step_status”: “failed”
},
“retry_info”: {
“failed”: false,
“consumed_retries”: 0
},
“info”: {
“message”: “Missing alias or not the write index when rollover [index=security-auditlog-2023.07.19]”
},
“enabled”: false
},
“total_managed_indices”: 1
}
The index security-auditlog-2023.07.19 does not have a alias, so the policy executed failed. And why the audit log index was attached with a ISM policy? I think it’s not needed, the audit log index will rollover everyday automatically, we do not need to do extra work for it.
Dear friend, I tried with another index, I don’t know what I’m doing wrong, please help me, what I want is for my policy to delete the indexes after a certain time, so that the storage does not fill up
The policy managed index does not have an alias, so the rollover action failed, check by this API:
GET {index}/_alias. The index nginx-ggg-xxx-2023.07.20 has a date suffix, it seems that it will be created daily, so you do not need the rollover action in your ISM policy, like this:
{
"id": "a",
"seqNo": 85648,
"primaryTerm": 41,
"policy": {
"policy_id": "a",
"description": "A sample description of the policy",
"last_updated_time": 1690343768549,
"schema_version": 18,
"error_notification": null,
"default_state": "search",
"states": [
{
"name": "search",
"actions": [],
"transitions": [
{
"state_name": "delete",
"conditions": {
"min_index_age": "1d"
}
}
]
},
{
"name": "delete",
"actions": [
{
"retry": {
"count": 3,
"backoff": "exponential",
"delay": "1m"
},
"delete": {}
}
],
"transitions": []
}
],
"ism_template": []
}
}
Dear, indeed execute the API:
GET nginx-ggg-xxx-2023.07.20/_alias
and the index does not have an alias:
{
“nginx-ggg-xxx-2023.07.20”: {
“aliases”: {}
}
}
my question is, if my index has a date suffix and will be created daily does it need an action?
Can I do in that action that reduces the number of replicas and then eliminate them?
On the other hand, I want to thank you because the policy you attached worked perfectly. I am very grateful for your time, thank you
@FepitoBol you’re welcome. Yeah, Replica count action can reduce the number of replicas of the index, you can add the action in a state like warm state before the delete state.
@gaobinlong indeed, add a warm state in which it reduces the number of replicas and then goes to the delete state, the code is as follows:
PUT _plugins/_ism/policies/policy_5
{
"policy": {
"policy_id": "policy_5",
"description": "ingesting logs",
"default_state": "search",
"states": [
{
"name": "search",
"actions": [],
"transitions": [
{
"state_name": "tibio",
"conditions": {
"min_index_age": "1d"
}
}
]
},
{
"name": "tibio",
"actions": [
{
"replica_count": {
"number_of_replicas": 0
}
}
],
"transitions": [
{
"state_name": "delete",
"conditions": {
"min_index_age": "1d"
}
}
]
},
{
"name": "delete",
"actions": [
{
"retry": {
"count": 3,
"backoff": "exponential",
"delay": "1m"
},
"delete": {}
}
],
"transitions": []
}
],
"ism_template": []
}
}
It will only be to modify the number of days. thanks again
On the other hand, I still have the question of the alias. Should I create an alias to the index first?
If you use the rollover action and want ISM to rollover your index automatically, you should add an alias to the index firstly, but in your case It’s not required.
@gaobinlong thank you so much, your help was very valuable
