0

I have both Elasticsearch and Logstash in version 7.9.1-1 installed. Here's the policy I've created:

PUT _ilm/policy/test-policy

{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_age": "2d"
          }
        }
      }
    }
  }
}

And its corresponding template:

PUT _template/test-template

{
  "index_patterns": ["test-*"],
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1,
    "index.lifecycle.name": "test-policy",
    "index.lifecycle.rollover_alias": "test-read_n_write"
  }
}

And, finally, the initial alias:

PUT test-000001

{
  "aliases": {
    "test-read_n_write":{
      "is_write_index": true
    }
  }
}

After the first rollover, I'd like to have the alias point to the newly generated index (i.e. test-000002) only for both read and write operations - instead of just writing to the most recent one and searching multiple indices with the test-read_n_write alias.

Am I able to do that with automatic rollover?

Rfroes87
  • 668
  • 1
  • 5
  • 15
  • 1
    Do you still need the old index or you will never read from it anymore? – Val Oct 19 '20 at 14:04
  • @Val I need it for searching through a secondary "general" alias, which in this case would search through all indices. – Rfroes87 Oct 19 '20 at 14:06
  • 1
    I don't understand why you have two different aliases, though... `sslvpntraffic-write` and `test-read_n_write` can you explain in more details what they do? – Val Oct 19 '20 at 14:07
  • @Val My bad, missed editing that part out. Fixed it now. – Rfroes87 Oct 19 '20 at 14:08
  • 2
    Tough one, as the whole point of ILM is twofold: 1) enable writes into a the latest index + 2) enable reads from all historical indexes – Val Oct 19 '20 at 14:13
  • @Val I see, so I'm assuming that would basically go against the design of ILM and so there's no way it could be achieved through conventional means? – Rfroes87 Oct 19 '20 at 14:16
  • 1
    You can achieve anything you desire, just maybe not with a single command. It's definitely possible to manage that yourself using the `_aliases` endpoint. You're completely free as to where you want your aliases to point to. – Val Oct 19 '20 at 14:17
  • @Val Would you consider scheduling the alias update through a cronjob to be a bad workaround? – Rfroes87 Oct 19 '20 at 14:37
  • 1
    Not necessarily, since your rollover will happen every two days, you can schedule the alias update around the same time (but after the rollover) – Val Oct 19 '20 at 14:41

0 Answers0