0

我已经为索引的热-暖-冷-删除转换设置了 ISM 策略。

在我的场景中,我将索引从冷存储中移出以在温暖中使用它,但我试图弄清楚下一次 ISM 运行会发生什么。我的索引最终会通过 ISM 策略被删除,还是我有责任手动将其移回冷存储?

{
"policy_id": "policy_id_stackoverflow",
"description": "x",
"last_updated_time": 1646341032637,
"schema_version": 1,
"error_notification": null,
"default_state": "ReadWrite",
"states": [
    {
        "name": "ReadWrite",
        "actions": [
            {
                "read_write": {}
            }
        ],
        "transitions": [
            {
                "state_name": "Ultrawarm",
                "conditions": {
                    "min_index_age": "1d"
                }
            }
        ]
    },
    {
        "name": "Ultrawarm",
        "actions": [
            {
                "timeout": "24h",
                "retry": {
                    "count": 5,
                    "backoff": "exponential",
                    "delay": "1h"
                },
                "warm_migration": {}
            },
            {
                "notification": {
                    "destination": {
                        "slack": {
                            "url": "https://url-stackoverflow-redacted"
                        }
                    },
                    "message_template": {
                        "source": "REDACTED",
                        "lang": "mustache"
                    }
                }
            }
        ],
        "transitions": [
            {
                "state_name": "Cold",
                "conditions": {
                    "min_index_age": "2d"
                }
            }
        ]
    },
    {
        "name": "Cold",
        "actions": [
            {
                "retry": {
                    "count": 5,
                    "backoff": "exponential",
                    "delay": "1h"
                },
                "cold_migration": {
                    "start_time": null,
                    "end_time": null,
                    "timestamp_field": "@timestamp",
                    "ignore": "none"
                }
            },
            {
                "notification": {
                    "destination": {
                        "slack": {
                            "url": "REDACTED"
                        }
                    },
                    "message_template": {
                        "source": "REDACTED",
                        "lang": "mustache"
                    }
                }
            }
        ],
        "transitions": [
            {
                "state_name": "Delete",
                "conditions": {
                    "min_index_age": "15d"
                }
            }
        ]
    },
    {
        "name": "Delete",
        "actions": [
            {
                "notification": {
                    "destination": {
                        "slack": {
                            "url": "REDACTED"
                        }
                    },
                    "message_template": {
                        "source": "REDACTED",
                        "lang": "mustache"
                    }
                }
            },
            {
                "cold_delete": {}
            }
        ],
        "transitions": []
    }
],
"ism_template": [
    {
        "index_patterns": [
            "apperrors*",
            "applogs-core*"
        ],
        "priority": 0,
        "last_updated_time": 1646330772853
    }
]

}

4

0 回答 0