ElasticSearch ILM试玩

ElasticSearch ILM试玩

创建一个生命周期管理策略

官方给的例子

PUT _ilm/policy/datastream_policy   
{
  "policy": {                       
    "phases": {
      "hot": {                      
        "actions": {
          "rollover": {             
            "max_size": "50GB",
            "max_age": "30d"
          }
        }
      },
      "delete": {
        "min_age": "90d",           
        "actions": {
          "delete": {}              
        }
      }
    }
  }
}

自己随便造一个，完全可以在Kibana界面上完成操作~

GET _ilm/policy

{
  "ljktest_policy" : {
    "version" : 1,
    "modified_date" : "2020-08-17T04:41:55.293Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "1mb",
              "max_age" : "1h",
              "max_docs" : 1
            }
          }
        },
        "delete" : {
          "min_age" : "4h",
          "actions" : {
            "delete" : { }
          }
        }
      }
    }
  }
}

创建一个带有策略的索引副本

官方示例

PUT _template/datastream_template
{
  "index_patterns": ["datastream-*"],                 
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1,
    "index.lifecycle.name": "datastream_policy",      
    "index.lifecycle.rollover_alias": "datastream"    
  }
}

自己造一个

GET _template/ljktest_template

{
  "ljktest_policy" : {
    "version" : 1,
    "modified_date" : "2020-08-17T04:41:55.293Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "1mb",
              "max_age" : "1h",
              "max_docs" : 1
            }
          }
        },
        "delete" : {
          "min_age" : "4h",
          "actions" : {
            "delete" : { }
          }
        }
      }
    }
  }
}

写入索引文档测试

PUT ljktest-000001
{
  "aliases": {
    "ljktest": {
      "is_write_index": true
    }
  }
}

POST ljktest/origin
{
  "name":"ljktest004"
}

测试的一些问题疑惑

1. 设置的是1个文档就rollover，连续放入了好几个文档，也不会生成新的index。比如ljktest-000001已经有7个文档了。后面我也不懂它根据什么规则生成了一个ljktest-000002的索引。
2. 这种场景在应对ID不确定，也就是log日志文件，不错。 但是当我的数据需要不断迭代更新的场景，但是又想根据某个时间字段删除掉90天后的数据，这种ILM的策略貌似不能满足啊。比如以下的两笔数据会让接口同时查询到，这种就不太合理~

 {
        "_index" : "ljktest-000001",
        "_type" : "origin",
        "_id" : "001",
        "_score" : 1.0,
        "_source" : {
          "name" : "ljktest006"
        }
      },
      {
        "_index" : "ljktest-000002",
        "_type" : "origin",
        "_id" : "001",
        "_score" : 1.0,
        "_source" : {
          "name" : "ljktest006"
        }
      },