I am looking to implement a policy and I had a few questions/concerns about how things should flow.
Starting state: “Hot”
Hot State:
- Rollover at min_size 40gb.
- Transition:
- if min_size 40gb, go to “warm” ← At this point I assume if this gets hit then the rollover will have always been done. Is there a chance that during action phase, it is under 40, then at transition it is over 40? or does it only grab the size for evaluation once at the start?
- if past (cron statement) go to “hot rollover”
Hot rollover state
- rollover at min_doc count 1
- Transition
- if min_doc_count 1 go to “warm” ← kind of the same question as above
warm
- set to read only
…
or should I swap to something like
Hot state:
- no actions
- Transitions:
- if min_size 40gb go to “rolling”
- if past cron expression go to “rolling”
Rolling state:
- rollover if min_doc_count 1
- Transition to “Warm” if min_doc_count 1
… etc
I am basically looking for a clean way to cut the data into weeks/months using rollover. I realize this might lead to a few logs leaking in (since the ism process is run on a delay), but IMO it is better than an index “index-2021.04-0000X” being created at 11:30pm on April 30th, getting all of the first few weeks of Mays logs until it rolls over later in the month.