Index policy not working

18 views
Skip to first unread message

Cristian Radu

unread,
Mar 27, 2023, 11:54:40 AM3/27/23
to Wazuh mailing list
Hello,

I have the following index policy, but my indices are not moving to cold state, even thought 180days have passed. Is there something wrong with it?

{ "id": "hot_warm_cold_delete_workflow", "seqNo": 181, "primaryTerm": 1, "policy": { "policy_id": "hot_warm_cold_delete_workflow", "description": "A simple default policy that changes the replica count between hot and cold states.", "last_updated_time": 1667310926598, "schema_version": 12, "error_notification": null, "default_state": "hot", "states": [ { "name": "hot", "actions": [], "transitions": [ { "state_name": "warm", "conditions": { "min_index_age": "30d" } } ] }, { "name": "warm", "actions": [], "transitions": [ { "state_name": "cold", "conditions": { "min_index_age": "180d" } } ] }, { "name": "cold", "actions": [ { "retry": { "count": 1, "backoff": "exponential", "delay": "1m" }, "close": {} } ], "transitions": [ { "state_name": "delete", "conditions": { "min_index_age": "366d" } } ] }, { "name": "delete", "actions": [ { "retry": { "count": 1, "backoff": "exponential", "delay": "1m" }, "delete": {} } ], "transitions": [] } ], "ism_template": [ { "index_patterns": [ "wazuh-alerts*" ], "priority": 1, "last_updated_time": 1667310926598 }, { "index_patterns": [ "wazuh-archives*" ], "priority": 1, "last_updated_time": 1667310926598 } ] } }

Thanks,
Cristian

Emiliano Zorn

unread,
Mar 27, 2023, 12:40:26 PM3/27/23
to Wazuh mailing list
Hello Cristian!

Thank you for writing to us.

I was evaluating your policy, and apparently, there are some syntax and coding errors.

Here is an example of a policy implementing the index states to prioritize resources:
https://opensearch.org/docs/latest/im-plugin/ism/policies/#example-policy


You can find it in the following link, along with more examples:

Regards.
Reply all
Reply to author
Forward
0 new messages