Policy that deletes Indexes after 30 days

Plugins Index Management
1

I’m attempting to create a policy that deletes any index that is older than 30 days but it doesn’t appear to be working. The indexes do not delete.

I would also like this policy to apply to new index when they are created.

{
“policy”: {
“policy_id”: “DELETE_OLDER_THAN_30D”,
“description”: “Policy that deletes indicies older than 30 days.”,
“last_updated_time”: 1581005749328,
“schema_version”: 1,
“error_notification”: null,
“default_state”: “open”,
“states”: [
{
“name”: “open”,
“actions”: [
{
“open”: {}
}
],
“transitions”: [
{
“state_name”: “delete”,
“conditions”: {
“min_index_age”: “30d”
}
}
]
},
{
“name”: “delete”,
“actions”: [
{
“delete”: {}
}
],
“transitions”:
}
]
}
}

2

When you say does not appear to be working can you be more specific?
Assuming you applied the policy to an index, is it stuck at a certain point in the policy?
Can you do a _opendistro/_ism/explain/ call to see what the explain status shows?
Any extra information/screenshots will help.

As for applying the policy to new indices, you can do that with the help of index templates.

Thanks,
Drew

3

It appears to be at the state: “Attempting to transition”

winlogbeat-7.3.2-2020.01.23
DELETE_OLDER_THAN_30D
open
Transition
Attempting to transition
Running

winlogbeat-7.3.2-2020.01.24
DELETE_OLDER_THAN_30D
open
Transition
Attempting to transition
Running

winlogbeat-7.3.2-2020.01.25
DELETE_OLDER_THAN_30D
open
Transition
Attempting to transition
Running

What would that call look like from Devtools? When doing GET _opendistro/_ism/explain/ I get:

{
“error”: {
“root_cause”: [
{
“type”: “illegal_argument_exception”,
“reason”: “Missing indices”
}
],
“type”: “illegal_argument_exception”,
“reason”: “Missing indices”
},
“status”: 400

4

Hi @Ech0,

For the explain API call you have to provide the index name(s) or *, so something like
GET _opendistro/_ism/explain/*

From the index names you provided, it doesn’t look like they are over 30 days old?
30 days ago appears to be January 22nd as of this post, and those index names show January 23 as the earliest.

5

Sorry I never replied to this, I forgot I had posted it. But I ended up figuring out my issue.

I needed create a template that added new indexes to the policy automatically, once I had done that, everything began working as expected.