github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 17:28:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

[DOCS] Adds information about enabling/disabling rollover (#33600)

Browse source
This commit is contained in:
gchaps 2019-03-20 13:28:46 -07:00 • committed by gchaps
parent 3b5450a19b
commit 222e805235
1 changed files with 25 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/management/index-lifecycle-policies/create-policy.asciidoc
View file

@ -24,17 +24,16 @@ image::images/index-lifecycle-policies-create.png[][UI for creating an index lif
==== Defining the phases of the index lifecycle
You can define up to four phases in the index lifecycle. For each phase, you
can enable actions to optimize performance for that phase. Transitioning
between phases is based on the age of the index.
can enable actions to optimize performance for that phase.
The four phases in the index lifecycle are:
* *Hot.* The index is actively being queried and written to. You can optionally
* *Hot.* The index is actively being queried and written to. You can
roll over to a new index when the
original index reaches a specified size or age. When a rollover occurs, a new
original index reaches a specified size, document count, or age. When a rollover occurs, a new
index is created, added to the index alias, and designated as the new “hot”
index. You can still query the previous indices, but you only ever write to
the “hot” index. See {ref}/indices-rollover-index.html[Rollover index] for more information.
the “hot” index. See <<setting-a-rollover-action>>.
* *Warm.* The index is typically searched at a lower rate than when the data is
hot. The index is not used for storing new data, but might occasionally add
@ -60,6 +59,27 @@ delete phases are optional. For example, you might define all four phases for
one policy and only a hot and delete phase for another. See {ref}/_actions.html[Actions]
for more information on the actions available in each phase.
[[setting-a-rollover-action]]
==== Setting a rollover action
The {ref}/indices-rollover-index.html[rollover] action enables you to automatically roll over to a new index based
on the index size, document count, or age. Rolling over to a new index based on
these criteria is preferable to time-based rollovers. Rolling over at an arbitrary
time often results in many small indices, which can have a negative impact on performance and resource usage.
When you create an index lifecycle policy, the rollover action is enabled
by default. The default size for triggering the rollover is 50 gigabytes, and
the default age is 30 days. The rollover occurs when any of the criteria are met.
With the rollover action enabled, you can move to the warm phase on rollover or you can
time the move for a specified number of hours or days after the rollover. The
move to the cold and delete phases is based on the time from the rollover.
If you are using daily indices (created by Logstash or another client) and you
want to use the index lifecycle policy to manage aging data, you can
disable the rollover action in the hot phase. You can then
transition to the warm, cold, and delete phases based on the time of index creation.
==== Setting the index priority
For the hot, warm, and cold phases, you can set a priority for recovering