Index State Management priority ordering

OpenSearch
1

Versions:

  • 2.3

Description:
I am writing multiple ISM policies to accurately manage how much data is being stored in my OpenSearch cluster.

I have a generic index pattern of application-* for all application-related logs and another index pattern of application-nginx-*for NGINX logs.

Configuration:

  • ISM Policy 1:
    • Index pattern: application-*
    • Delete age: 14d
    • Priority: 1
  • ISM Policy 2:
    • Index pattern: application-nginx-*
    • Delete age: 4d
    • Priority: 2

Will the ISM Policy 2 still delete index data that’s aged over 4 days even if it’s a lower priority? Also, how often are ISM polices evaluated by the OpenSearch cluster? Every minute? Every 30 minutes?

I updated my ISM to delete NGINX logs older than 4 days and I haven’t seen any +4d data being deleted from OpenSearch in the last few hours.

Your help and feedback is much appreciated. Thank you!

1 Like