Creating Rollover of an Index
About this task

- performancemetrics
- policyviolationevents
- monitorevents
- errorevents
- threatprotectionevents
- transactionalevents
- lifecycleevents
- auditlogs
- log
- serverlogtrace
- mediatortrace
- requestresponsetrace
To create rollover of an index
Procedure
Conditions that can be given with rollover command
About this task
Condition | Description |
---|---|
maxAge | Maximum age of the indexes.
The specified indexes are rolled over if they are older than the value provided for this condition. For the list of possible values for this field, see https://www.elastic.co/guide/en/elasticsearch/reference/master/api-conventions.html#time-units. For example, to roll over the
monitorevents index if it is older
than 2 minutes, you can provide
|
maxDocs | Maximum number of the documents in the
indexes.
The specified indexes are rolled over if the number of documents in the indexes are more than or equal to the value provided for this condition. For example, to roll over the
monitorevents index if the number of
documents in the index is more than or equal to 100, you can provide
|
maxSize | Maximum size of the indexes.
The specified indexes are rolled over if their size is equal to or more than the value provided in this condition. For the list of possible values for this field, see https://www.elastic.co/guide/en/elasticsearch/reference/master/api-conventions.html#byte-units. For example, to roll over the
monitorevents index if its size is
more than 1 GB, you can provide
|
maxPrimaryShardSize | Maximum size of the primary shard of the
indexes.
The specified indexes are rolled over if the size of their primary shards is equal to or more than the value provided for this condition. For example, to roll over the
monitorevents index if the size of
the index's primary shard is more than or equal to 1 GB, you can provide
|