Settings for .opensearch-alerting-finding-history and .opensearch-alerting-queries indices


OpenSearch v2.6.0


Hi OpenSearch team,

When reviewing the cluster indices I have found the following related to alerting:

  • .opensearch-alerting-finding-history-2023.07.12-1
  • .opensearch-alerting-queries-000001

I have been reviewing the documentation to configure the rollover and deletion of these indexes, but I have not found any settings related to them.

I was expecting settings similar to the ones used for .opendistro-alerting-alert-history:

  • Related to rollover:
    • plugins.alerting.alert_history_rollover_period
    • plugins.alerting.alert_history_max_age
    • plugins.alerting.alert_history_max_docs
  • Related to the index deletion:
    • plugins.alerting.alert_history_retention_period

:question: Are there any settings for managing the .opensearch-alerting-finding-history-* and .opensearch-alerting-queries-* indices?

I know I could use ISM for this matter, but I was expecting them to have some sort of default settings for rollover and deletion.

Best regards,
Mayte Ariza.

Yes, you have same settings for findings indices: plugins.alerting.alert_finding_rollover_period

“alerting-queries” indices are handled internally. Currently there are few edge cases where alerting would miss deleting unused query indices. This PR is addressing that.

1 Like

Thank you very much for the update! I could not find any related setting in the documentation.

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.