ISM policy rollover to index template associated to aliases

[Zeus29]

I have followed the steps below to create from scratch an index template that has an alias associated with it and apply a rollover policy to it, but no new indexes are generated when the condition is met.

1. Creation of an ISM policy for the rotation of indices. I have set the “min_doc_count” option to “1” to test that the settings work and new indexes are generated.

PUT _plugins/_ism/policies/fw_fortigate_rollover_ism_policy
{
  "policy": {
    "description": "",
    "default_state": "rollover",
    "states": [
      {
        "name": "rollover",
        "actions": [
          {
            "rollover": {
              "min_index_age": "7d",
              "min_doc_count": "1",
              "min_size": "50gb"
            }
          }
        ]
      }
    ],
    "ism_template": {
      "index_patterns": ["fw-fortigate-*"]
    }
  }
}

2. Creation of an index template:

POST _index_template/fw-fortigate
{
  "index_patterns": [
    "fw-fortigate-*"
  ],
  "template": {
    "settings": {
      "plugins.index_state_management.policy_id": "fw_fortigate_rollover_ism_policy"
    },
    "aliases": {
      "fw-fortigate-alias": {}
    },
    "mappings": {}
  },
  "priority": 200,
  "composed_of": [
    "shards_basic_settings_component"
  ],
  "version": 1,
  "_meta": {
    "description": ""
  }
}

3. Generation of an index to which you apply the index template.

PUT fw-fortigate-000001

4. Configure the search alias to make the index “fw-fortigate-000001” writable.

POST _aliases
{
  "actions": [
    {
      "add": {
        "index": "fw-fortigate-*",
        "alias": "fw-fortigate-alias"
      }
    },
    {
      "add": {
        "index": "fw-fortigate-000001",
        "alias": "fw-fortigate-alias",
        "is_write_index": true
      }     
    }
  ]
}

5. Generation of test documents

POST fw-fortigate-alias/_doc/
{
  "@timestamp": "2022-04-04T10:00:00",
  "message": "Test doc."
}

Although I generate several test documents and the index “fw-fortigate-000001” has more than one document, a new index “fw-fortigate-000002” with the search alias “fw-fortigate-alias” is not automatically generated.

I would like to be able to use the search alias “fw-fortigate-alias” to be able to point to this in my logstash configuration.

Any idea what the problem might be? What step am I doing wrong?

Very thanks.

[dbbaughe]

Hi @Zeus29,

I believe you are missing the rollover_alias setting in the index template and need to also apply that setting to the first index.

Since an index can have multiple aliases… ISM needs to know which alias you want to rollover and we rely on the rollover_alias setting to do that. I don’t believe I saw this being set in your description.

index.plugins.index_state_management.rollover_alias

(Inside the index template you’d remove that index prefix above)

Policies