Elasticsearch notes | DevOps Journey

Create Policy

PUT _ilm/policy/margick-logs
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_age": "1h",
            "max_size": "100mb",
            "max_primary_shard_size": "50mb"
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "warm": {
        "min_age": "2h",
        "actions": {
          "forcemerge": {
            "max_num_segments": 1
          },
          "readonly": {},
          "set_priority": {
            "priority": 50
          },
          "shrink": {
            "number_of_shards": 1
          },
          "allocate": {
            "number_of_replicas": 0
          }
        }
      },
      "cold": {
        "min_age": "3h",
        "actions": {
          "readonly": {},
          "set_priority": {
            "priority": 10
          },
          "allocate": {
            "number_of_replicas": 0
          }
        }
      },
      "delete": {
        "min_age": "4h",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": true
          }
        }
      }
    }
  }
}

Create Index Template

PUT _index_template/margick-logs-magicak
{
  "index_patterns": [
    "margick-logs-magicak-ns-*"
  ],
  "priority": 100,
  "template": {
    "settings": {
      "index.lifecycle.name": "margick-logs",
      "index.lifecycle.rollover_alias": "margick-logs-magicak-ns",
      "number_of_shards": 2,
      "number_of_replicas": 0
    }
  }
}

Create seed index

PUT margick-logs-magicak-000001
{
  "settings": {
    "number_of_shards": 2,
    "number_of_replicas": 0
  },
    "aliases": {
      "margick-logs-magicak-ns": {
        "is_write_index": true
      }
    }
}