我已经为索引的热-暖-冷-删除转换设置了 ISM 策略。
在我的场景中,我将索引从冷存储中移出以在温暖中使用它,但我试图弄清楚下一次 ISM 运行会发生什么。我的索引最终会通过 ISM 策略被删除,还是我有责任手动将其移回冷存储?
{
"policy_id": "policy_id_stackoverflow",
"description": "x",
"last_updated_time": 1646341032637,
"schema_version": 1,
"error_notification": null,
"default_state": "ReadWrite",
"states": [
{
"name": "ReadWrite",
"actions": [
{
"read_write": {}
}
],
"transitions": [
{
"state_name": "Ultrawarm",
"conditions": {
"min_index_age": "1d"
}
}
]
},
{
"name": "Ultrawarm",
"actions": [
{
"timeout": "24h",
"retry": {
"count": 5,
"backoff": "exponential",
"delay": "1h"
},
"warm_migration": {}
},
{
"notification": {
"destination": {
"slack": {
"url": "https://url-stackoverflow-redacted"
}
},
"message_template": {
"source": "REDACTED",
"lang": "mustache"
}
}
}
],
"transitions": [
{
"state_name": "Cold",
"conditions": {
"min_index_age": "2d"
}
}
]
},
{
"name": "Cold",
"actions": [
{
"retry": {
"count": 5,
"backoff": "exponential",
"delay": "1h"
},
"cold_migration": {
"start_time": null,
"end_time": null,
"timestamp_field": "@timestamp",
"ignore": "none"
}
},
{
"notification": {
"destination": {
"slack": {
"url": "REDACTED"
}
},
"message_template": {
"source": "REDACTED",
"lang": "mustache"
}
}
}
],
"transitions": [
{
"state_name": "Delete",
"conditions": {
"min_index_age": "15d"
}
}
]
},
{
"name": "Delete",
"actions": [
{
"notification": {
"destination": {
"slack": {
"url": "REDACTED"
}
},
"message_template": {
"source": "REDACTED",
"lang": "mustache"
}
}
},
{
"cold_delete": {}
}
],
"transitions": []
}
],
"ism_template": [
{
"index_patterns": [
"apperrors*",
"applogs-core*"
],
"priority": 0,
"last_updated_time": 1646330772853
}
]
}