You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: manage-data/lifecycle/index-lifecycle-management/rollover.md
+27-22Lines changed: 27 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,66 +10,71 @@ products:
10
10
# Rollover [index-rollover]
11
11
12
12
In {{es}}, the [rollover action](elasticsearch://reference/elasticsearch/index-lifecycle-actions/ilm-rollover.md) replaces your active write index with a new one whenever your index grows too large, too old, or stores too many documents.
13
-
This is particularly useful for time-series data, such as logs or metrics, where index growth is continuous and performance can degrade over time.
13
+
This is particularly useful for time-series data, such as logs or metrics where index growth is continuous, in order to meet performance and retention requirements.
14
14
15
-
Without rollover, a single index can grow until searches slow down, shard relocation takes hours, and nodes run low on disk space.
15
+
Without rollover, a single index would continue to grow, causing search performance to drop and having a higher administrative burden on the cluster.
16
16
17
-
The rollover feature is an important part of how [index lifecycle](../index-lifecycle-management/index-lifecycle.md) and [data stream lifecycles](../data-stream.md) work to keep your indices fast and manageable. By switching the write target of an index, the rollover action provides the following benefits:
17
+
The rollover feature is an important part of how [index lifecycle](../index-lifecycle-management/index-lifecycle.md)(ILM) and [data stream lifecycles](../data-stream.md) (DLM) work to keep your indices fast and manageable. By switching the write target of an index, the rollover action provides the following benefits:
18
18
19
-
***Automation** - works with ILM to remove manual index rotation tasks and allows for granular control over retention cycles
19
+
***Lifecycle** - works with lifecycle management (ILM or DLM) to transition the index through its lifecycle actions and allows for granular control over retention cycles
***Queries run faster** - improves search performance
22
22
23
-
Rollover can be triggered via the [API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-rollover)or ILM.
23
+
Rollover can be triggered via the [API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-rollover), ILM, or DLM.
24
24
25
25
## How rollover works in ILM
26
26
27
-
You define a rollover action in the hot phase of an index lifecycle policy. It will run when any of the configured thresholds are met.
27
+
You define a rollover action in the hot phase of an index lifecycle policy. It will run when any of the configured thresholds are met and the write index contains at least one document.
28
28
You can configure the following rollover conditions:
29
29
30
-
***Size** - an index will rollover when it reaches a set size, for example 50 GB.
30
+
***Size** - an index will rollover when its shards reach a set size, for example 50 GB.
31
31
***Age** - an index will rollover when an index reaches a certain age, for example 7 days.
32
32
***Document count** - an index will rollover when a shard contains a certain number of documents, for example 2 million.
33
33
34
34
::::{tip}
35
35
Rolling over to a new index based on size, document count, or age is preferable to time-based rollovers. Rolling over at an arbitrary time often results in many small indices, which can have a negative impact on performance and resource usage.
36
36
::::
37
37
38
-
After rollover occurs in the hot phase of an ILM policy, indices move to other index lifecycle phases like warm, cold, frozen, and delete. Rollover creates a new write index while the old one continues through the lifecycle phases.
38
+
After rollover, indices move to other index lifecycle phases like warm, cold, frozen, and delete. Rollover creates a new write index while the old one continues through the lifecycle phases.
39
39
40
40
**Special rules:**
41
41
42
-
*Empty indices rollover is blocked even if they have an associated `max_age` that would otherwise result in a roll over occurring. A policy can override this behavior if you set `min_docs: 0` in the rollover conditions. This can also be disabled on a cluster-wide basis if you set `indices.lifecycle.rollover.only_if_has_documents` to `false`.
42
+
*Rollover for an empty write index is skipped even if they have an associated `max_age` that would otherwise result in a roll over occurring. A policy can override this behavior if you set `min_docs: 0` in the rollover conditions. This can also be disabled on a cluster-wide basis if you set `indices.lifecycle.rollover.only_if_has_documents` to `false`.
43
43
* Forced rollover occurs if any shard reaches 200 million documents. Usually, a shard will reach 50 GB long before it reaches 200 million documents, but this isn’t the case for space efficient data sets.
44
44
45
45
## Recommended approaches
46
46
47
47
Decide your approach to index rotation based on your use case and requirements.
| Logs, metrics |[Data streams](rollover.md#rollover-data-stream)| Automatic rollover with lifecycle management, minimal setup, control over rollover timing <1> |
52
+
| Legacy indexing setup |[Alias-based rollover](rollover.md#rollover-with-aliases)| Granular control over rollover timing.<br> Note that this option requires advanced configuration steps. |
1. Rollover is handled automatically in Serverless projects, therefore rollover timing is abstracted from the user.
54
56
55
57
:::{tip}
56
-
For new projects, use data streams. They're simple to manage and handle rollover automatically.
58
+
For new projects, use data streams. They're simple to manage with lifecycle policies where you define phases and actions that handle rollover automatically.
57
59
:::
58
60
59
61
60
62
### Rotating your indices with data streams [rollover-data-stream]
61
63
62
-
We recommend using [data streams](../../data-store/data-streams.md) to manage time series data. Data streams automatically track the write index while keeping configuration to a minimum.
64
+
We recommend using [data streams](../../data-store/data-streams.md) to manage time series data. Data streams set up with lifecycle policies automatically track the write index while keeping configuration to a minimum.
63
65
When targeting a data stream, the new backing index becomes the data stream's writing index. The generation of new backing indices is incremented automatically when it reaches a specified age or size.
64
66
65
67
Each data stream requires an [index template](../../data-store/templates.md) that contains the following:
66
68
67
69
* A name or wildcard (`*`) pattern for the data stream.
68
-
* The data stream’s timestamp field. This field must be mapped as a [`date`](elasticsearch://reference/elasticsearch/mapping-reference/date.md) or [`date_nanos`](elasticsearch://reference/elasticsearch/mapping-reference/date_nanos.md) field data type and must be included in every document indexed to the data stream.
69
-
* The mappings and settings applied to each backing index when it’s created.
70
+
* Optional: The mappings and settings applied to each backing index when it’s created.
70
71
71
72
For more information about this approach, refer to the [Manage time series data with data streams](../index-lifecycle-management/tutorial-automate-rollover.md#manage-time-series-data-with-data-streams) tutorial.
72
73
74
+
:::{tip}
75
+
Data streams are designed for append-only data, where the data stream name can be used as the operations (read, write, rollover, shrink etc.) target. If your use case requires data to be updated in place, you can perform [update or delete operations directly on the backing indices](../../data-store/data-streams/use-data-stream.md#update-delete-docs-in-a-backing-index).
76
+
:::
77
+
73
78
**Data streams naming pattern**<br>
74
79
{{es}} uses a structured naming convention for the backing indices of data streams, following this pattern:
75
80
@@ -80,18 +85,18 @@ For more information about data stream naming patterns, refer to the [Generation
80
85
81
86
### Rotating your indices with aliases [rollover-with-aliases]
82
87
83
-
Data streams are designed for append-only data, where the data stream name can be used as the operations (read, write, rollover, shrink etc.) target. If your use case requires data to be updated in place, you can instead manage your time series data using [index aliases](../../data-store/aliases.md). However, this approach requires additional configuration steps, including bootstrapping the initial index. For more details about this approach, refer to the [Manage time series data without data streams](../index-lifecycle-management/tutorial-automate-rollover.md#manage-time-series-data-without-data-streams) tutorial.
88
+
Rotating indices with aliases requires additional configuration steps, including bootstrapping the initial index. For more details about this approach, refer to the [Manage time series data without data streams](../index-lifecycle-management/tutorial-automate-rollover.md#manage-time-series-data-without-data-streams) tutorial.
84
89
85
90
:::{important}
86
-
To roll over an index alias, the alias and its [write index](../../data-store/aliases.md#write-index) must meet the following conditions:
91
+
The use of aliases for rollover requires meeting certain conditions. Review these considerations before applying this approach:
87
92
88
93
* The index name must match the pattern `^.-\d+$*`, for example `my-index-000001`.
89
94
* The `index.lifecycle.rollover_alias` must be configured as the alias to roll over.
90
-
* The index must be the write index for the alias.
95
+
* The index must be the [write index](../../data-store/aliases.md#write-index) for the alias.
91
96
:::
92
97
93
98
::::{note}
94
-
When an index is rolled over, the previous index’s age is updated to reflect the rollover time. This date, rather than the index’s `creation_date`, is used in {{ilm}} `min_age` phase calculations. [Learn more](../../../troubleshoot/elasticsearch/index-lifecycle-management-errors.md#min-age-calculation).
99
+
When an alias or data stream is rolled over, the previous write index’s rollover time is stored. This date, rather than the index’s `creation_date`, is used in {{ilm}} `min_age` phase calculations. [Learn more](../../../troubleshoot/elasticsearch/index-lifecycle-management-errors.md#min-age-calculation).
0 commit comments