the index rollover situation

warning / lessons learned

handling rollover and life-cycle of casual indices is much harder than dealing with data-streams

create mgmt policy

nothing special yet – see policy-mgmt

prepare alias write index

do not send logs yet, prepare the write index first

Dev Tools

PUT test-000001
{
  "aliases": {
    "test-alias":{
      "is_write_index": true 
    }
  }
}

create index template

name        test-tpl
type        index
pattern     test-*
alias       NONE (NOT ROLLOVER ALIAS)
adv settings

{
  "index.plugins.index_state_management.rollover_alias": "test-alias"
}

mapping

{
  "numeric_detection": true,
  "dynamic": "true",
  "date_detection": false
}

acceptance

send some logs to the rollover alias and define an index pattern to check the index field

==> goes to test-000001

also back to index mgmt, that index shows up under the test policy

resources

https://opster.com/guides/elasticsearch/data-architecture/index-lifecycle-policy-management/