Policy to delete by hours

Plugins Index Management
1

HI!
I need to delete some index 1 hour after its creation, is it possible? I have tried to put the following policy but it does not work:

{
"policy": {
    "policy_id": "deleteIndice1h",
    "description": "borrado después de 1 hora",
    "last_updated_time": 1592558358945,
    "schema_version": 1,
    "error_notification": null,
    "default_state": "hot",
    "states": [
        {
            "name": "hot",
            "actions": [],
            "transitions": [
                {
                    "state_name": "delete",
                    "conditions": {
                        "min_index_age": "1h"
                    }
                }
            ]
        },
        {
            "name": "delete",
            "actions": [
                {
                    "delete": {}
                }
            ],
            "transitions": []
        }
    ]
}

}

all the policies we manage are based on days and they work. how could I do this deletion based on hours?

Thanks!

2

Hi @Nat,

That should work. Can you give a bit more details on what the problem is?
Are you using ODFE or AmazonES? Which version? After you attach the policy to the index does it get stuck on something?

Thanks

3

Hi,
I’m using AmazonES version: 7.4. I only have 3 policies that apply: delete after 6 days for index “logs." with order 0, deleted after 1 days for index "logs.noteam.” with order 1 and deleted after 1 hours “logs.noteam.sessions-*” with order 2. First and second is working, third policies aren’t working. When I see Index managed policies I found the message: “Transitioning to delete”

image
image1569×258 29.4 KB

But more than 1 hour has passed since the index was created

4

Hi!
I have discover the indexes are deleted after 3h, even if I describe 1h in the settings. I don’t understand this. Do you know why it happens?
Many thanks!

5

Hi @Nat,

On Amazon Elasticsearch Service the job_interval is set to a larger time than on ODFE (30 minutes vs 5 minutes) so the jobs run a bit slower. This was initially done for performance considerations, but it’s something we will start to reduce in the future to speed up job executions. It seems like your policy is working fine, it’s just not running fast enough in your example. Do you need the data to actually be deleted within an hour or is it just for testing?

6

It’s ok, I was curious to know the reason.
So many thanks!