ISM policy to delete indices after X days

Versions 2.8.0

Describe the issue:

Hello,

I have Kubernetes clusters sending logs to OS. new index is created daily per cluster. The patterns used are dev-clusterxx-yyyy-mm-dd and prod-clusterxx-yyyy-mm-dd. I am having hard time getting simple ISM policy to delete indices after x days ( dev* after 7 days) ( prod* after 30 days).

I am not using aliases and would like to stay without using them for now.

How I can accomplish this ?

Thanks

Configuration:

{
    "policy": {
        "policy_id": "dev-delete7days",
        "description": "A sample description of the policy",
        "last_updated_time": 1688522639465,
        "schema_version": 17,
        "error_notification": {
            "channel": {
                "id": "vhtfI4kBanvl1499-UFq"
            },
            "message_template": {
                "source": "",
                "lang": "mustache"
            }
        },
        "default_state": "hot",
        "states": [
            {
                "name": "hot",
                "actions": [
                    {
                        "retry": {
                            "count": 3,
                            "backoff": "exponential",
                            "delay": "1m"
                        },
                        "rollover": {
                            "min_doc_count": 5,
                            "min_index_age": "1d"
                        }
                    }
                ],
                "transitions": [
                    {
                        "state_name": "warm"
                    }
                ]
            },
            {
                "name": "warm",
                "actions": [],
                "transitions": [
                    {
                        "state_name": "tobedeleted",
                        "conditions": {
                            "min_index_age": "6d"
                        }
                    }
                ]
            },
            {
                "name": "tobedeleted",
                "actions": [
                    {
                        "retry": {
                            "count": 3,
                            "backoff": "exponential",
                            "delay": "1m"
                        },
                        "delete": {}
                    }
                ],
                "transitions": []
            }
        ],
        "ism_template": [
            {
                "index_patterns": [
                    "dev*"
                ],
                "priority": 1,
                "last_updated_time": 1688522639465
            }
        ]
    }
}

Relevant Logs or Screenshots:

{
    "errorNotificationFailure": "text message part is null or empty",
    "message": "Missing rollover_alias index setting [index=dev-xxxx2023-07-09]"
}

I think this helps:

{
    "id": "test",
    "seqNo": 67149,
    "primaryTerm": 35,
    "policy": {
        "policy_id": "test",
        "description": "A sample description of the policy",
        "last_updated_time": 1688976288117,
        "schema_version": 18,
        "error_notification": null,
        "default_state": "init_state",
        "states": [
            {
                "name": "init_state",
                "actions": [],
                "transitions": [
                    {
                        "state_name": "delete_state",
                        "conditions": {
                            "min_index_age": "7d"
                        }
                    }
                ]
            },
            {
                "name": "delete_state",
                "actions": [
                    {
                        "retry": {
                            "count": 3,
                            "backoff": "exponential",
                            "delay": "1m"
                        },
                        "delete": {}
                    }
                ],
                "transitions": []
            }
        ],
        "ism_template": [
            {
                "index_patterns": [
                    "dev*"
                ],
                "priority": 1,
                "last_updated_time": 1688976054257
            }
        ]
    }
}
1 Like

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.