mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-06-30 02:13:33 -04:00
cfae69717a
PRs #73062 and #73043 repurposed the `alias` anchor for a new guide for index and data stream aliases. Previously, this anchor was used for our field alias documentation. Repurposing the anchor has caused continuity errors for users selecting different versions of the ES docs. It could also cause confusion for users with a `/current/` link to the `alias` page. This updates the anchor for the alias guide and adds a redirect page to disambiguate the `alias` anchor. It also fixes a bread crumb issue for redirects following the 'Modifying your Data' redirect page. Closes #77034.
55 lines
2.6 KiB
Text
55 lines
2.6 KiB
Text
[[index-rollover]]
|
|
=== Rollover
|
|
|
|
When indexing time series data like logs or metrics, you can't write to a single index indefinitely.
|
|
To meet your indexing and search performance requirements and manage resource usage,
|
|
you write to an index until some threshold is met and
|
|
then create a new index and start writing to it instead.
|
|
Using rolling indices enables you to:
|
|
|
|
* Optimize the active index for high ingest rates on high-performance _hot_ nodes.
|
|
* Optimize for search performance on _warm_ nodes.
|
|
* Shift older, less frequently accessed data to less expensive _cold_ nodes,
|
|
* Delete data according to your retention policies by removing entire indices.
|
|
|
|
We recommend using <<indices-create-data-stream, data streams>> to manage time series
|
|
data. Data streams automatically track the write index while keeping configuration to a minimum.
|
|
|
|
Each data stream requires an <<index-templates,index template>> that contains:
|
|
|
|
* A name or wildcard (`*`) pattern for the data stream.
|
|
|
|
* The data stream's timestamp field. This field must be mapped as a
|
|
<<date,`date`>> or <<date_nanos,`date_nanos`>> field data type and must be
|
|
included in every document indexed to the data stream.
|
|
|
|
* The mappings and settings applied to each backing index when it's created.
|
|
|
|
Data streams are designed for append-only data, where the data stream name
|
|
can be used as the operations (read, write, rollover, shrink etc.) target.
|
|
If your use case requires data to be updated in place, you can instead manage
|
|
your time series data using <<aliases,index aliases>>. However, there are a few
|
|
more configuration steps and concepts:
|
|
|
|
* An _index template_ that specifies the settings for each new index in the series.
|
|
You optimize this configuration for ingestion, typically using as many shards as you have hot nodes.
|
|
* An _index alias_ that references the entire set of indices.
|
|
* A single index designated as the _write index_.
|
|
This is the active index that handles all write requests.
|
|
On each rollover, the new index becomes the write index.
|
|
|
|
[discrete]
|
|
[role="xpack"]
|
|
[testenv="basic"]
|
|
[[ilm-automatic-rollover]]
|
|
=== Automatic rollover
|
|
|
|
{ilm-init} enables you to automatically roll over to a new index based
|
|
on the index size, document count, or age. When a rollover is triggered, a new
|
|
index is created, the write alias is updated to point to the new index, and all
|
|
subsequent updates are written to the new index.
|
|
|
|
TIP: Rolling over to a new index based on size, document count, or age is preferable
|
|
to time-based rollovers. Rolling over at an arbitrary time often results in
|
|
many small indices, which can have a negative impact on performance and
|
|
resource usage.
|