How to create ISM policy to metricbeat index

Plugins Index Management
1

Hi,

I have configured metricbeat and I am getting indices populated like metricbeat-7.9.1-2020.11.25. I would like to implement ISM to my current metricbeat index and to all upcoming metricbeat indices. I am trying to achieve this;

  1. metricbeat-7.9.1-2020.11.25 should be roled to metricbeat-7.9.1-2020.11.25-000001 on reaching 100mb, and then to metricbeat-7.9.1-2020.11.25-000002 on reaching the next 100mb, and so on.
  2. Indices should be automatically deleted after 1 day. I just need hot and delete phases only

I created a policy like this using kibana;

{
    "policy": {
        "policy_id": "metricbeat",
        "description": "Metricbeat delete old",
        "last_updated_time": 1606321584143,
        "schema_version": 1,
        "error_notification": null,
        "default_state": "hot",
        "states": [
            {
                "name": "hot",
                "actions": [
                    {
                        "replica_count": {
                            "number_of_replicas": 2
                        }
                    }
                ],
                "transitions": [
                    {
                        "state_name": "delete",
                        "conditions": {
                            "min_size": "100mb"
                        }
                    }
                ]
            },
            {
                "name": "delete",
                "actions": [
                    {
                        "delete": {}
                    }
                ],
                "transitions": []
            }
        ]
    }
}

Then, from Index Management > Indices, i selected the index metricbeat-7.9.1-2020.11.25-000002, and clicked Apply Policy Button. From the popup, i selected teh policy I just created and clicked the Apply button. Is this the right procedure, because indices are getting generated daily?

Can somebody please help me with the things I am trying to achieve?

Thanks in advance.

2

That will only apply the index policy to that particular index. If you want to assign the policy to every index created, you need to assign it to an index template . This can be done via the Elasticsearch REST API.

For example, if you use curl to PUT this payload to the _template/metricbeat-template endpoint of your Elasticsearch server (something like http://my_odfe_server:9200/_template/metricbeat-template), the index policy “metricbeat” will be applied to any index that has a name that fits the pattern “metricbeat-*”.

See the Elasticsearch TEMPLATE API doc (Create or update index template API | Elasticsearch Guide [7.16] | Elastic) for more details.

{
  "index_patterns": ["metricbeat-*"],
  "settings": {
    "opendistro.index_state_management.policy_id": "metricbeat"
  }
}
3

Hi @GSmith I got it.

Now, I have an index template metricbeat-7.9.1 and I have included the ISM policy in it. Is there anything need to me modified in the ISM policy I created? Well, I think my ISM is wrong.

I want this,

  1. rollover to another index (with number appended) on reaching 100 mb
  2. delete indices when their age become one day

I I would also like to know about rollover alias.

Thanks.