Rollover Alias, ILM and Data Tiers

Posted on | Edited on | In

At the time of this writing, we use Elasticsearch version 7.16.2, the reference is based on this version and the content may be subject to change.

Demo

Quick Demo to practice rollover alias and ILM.

Why not Data Stream

Manage time series data without data streams.

We recognise there might be use-cases where data needs to be updated or deleted in place and the data streams don’t support delete and update requests directly. In these cases, you can use an index alias to manage indices containing the time series data and periodically roll over to a new index.

Clarification

Note the difference between the rollover_alias field and the _alias API, the rollover_alias is configed in index template’s settings section and paired with ILM to ease rollover. The _alias API is more like a group operation to convenient the search, query, etc and you can also set write index for it.

In the Kibana template creation, there is a Alias page, it has nothing to do with rollover_alias.

After applying the rollover_alias, the managed backing index will have alias(you can see from GET or Kibana) and the _alias API works on it as well.

Reference for Alias API.

Logstash Plugin

Just like the data stream, the rollover_alias has its place in Logstash Elasticsearch output plugin, for example:

1
2
3
4
5
6
7
output {
    elasticsearch {
        ilm_rollover_alias => "custom"
        ilm_pattern => "000001"
        ilm_policy => "custom_policy"
    }
}

From document, this config will overwrite the index settings and adjust the Logstash template to write the necessary settings for the template to support index lifecycle management, including the index policy and rollover alias to be used, So looks like there is no need to preconfig the template to have rollover_alias and ILM, Logstash will do it.

0%