The index retention should be automatically managed to limit the number of opened indexes.
There are 2 types of indexes on the cluster:
The rules can be :
| rSPSITE puppet-swh-site | |||
| D5483 | rSPSITEbe73ab17df0c Puppetize the elasticsearch closing index script | ||
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Migrated | gitlab-migration | T3219 No logs are ingested on elasticsearch since 2021-03-26 | ||
| Migrated | gitlab-migration | T3221 elk: automatically limit log retention |
A script is regurarly executed to close the oldest indexes (30days) : P1004
It should be added on puppet and scheduled in a cron
^ Deployed
root@logstash0:~# cat /etc/cron.d/puppet-elasticsearch # Managed by puppet (module profile::cron), manual changes will be lost # Cron snippet elasticsearch-close-index 30 5 * * * root chronic sh -c '/usr/local/bin/elasticsearch_close_index.py --host esnode2.internal.softwareheritage.org --host esnode3.internal.softwareheritage.org --host esnode1.internal.softwareheritage.org --timeout 1200'