I have a policy using the index pattern logstash-* and with alias logstash-rollover. My first index is logstash-001 and it was created manually by me and attached to rollover alias.

After 50GB (my policy set max 50GB), another index is created: logstash-002, and it is ok for me. The problem is my second index get about 200GB and more, seems like policy is not applied to other indexes different from -001.

Index -001 : (check policy)

Index -002: (no policy here)

CodePudding user response：

Tldr;

The ILM policy name does not work with a pattern it is just the name of the policy.

You need to create an index template, which hold the ILM policy. This index template does use an index pattern, which should match your indices.

This tutorial explain it nicely.

Solution

Create a template

PUT _index_template/automated_ILM
{
  "index_patterns": ["logstash-*"],                   
  "template": {
    "settings": {
      "index.lifecycle.name": "<Your ILM policy name>"
      "index.lifecycle.rollover_alias": "logstash-rollover"   
    }
  }
}

Apply the ILM policy manually to the index logstash-002

PUT logstash-002/_settings 
{
  "index": {
    "lifecycle": {
      "name": "<Your ILM policy name>"
    }
  }
}

The do the rollover manually

POST logstash-rollover/_rollover

And you should be all set.