I am using elk version 8.0.0 in Windows OS. There are totally of 3 elk nodes 2 logstash and 1 kibana node.
The ILM is not working based on the duration I set (ex:5mints,the data is not getting deleted).I have created ILM template and assigned metricbeat 8.0.0 or metricbeat-*(tried with both) but data deletion is not happening. There is no error in all 3 Elasticsearch nodes logs and in kibana also and it's showing success while I click on the save policy.
Below is the source code which I implemented from my end (which is not working):
PUT _ilm/policy/metricbeat
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"set_priority": {
"priority": 100
}
}
},
"delete": {
"min_age": "5m",
"actions": {
"delete": {
"delete_searchable_snapshot": true
}
}
}
}
}
}
I had the same issue. Root cause for me that both replica and shard were on the same node (yellow status)
On console, send the following command to see on which phase your index in.
pay attention for this property in the response:
which indicates this issue