jertel / elastalert2

ElastAlert 2 is a continuation of the original yelp/elastalert project. Pull requests are appreciated!
https://elastalert2.readthedocs.org
Apache License 2.0
895 stars 282 forks source link

ElastAlert not automation re-create Index after elastalert Index deleted #1297

Closed quoctuan2311 closed 10 months ago

quoctuan2311 commented 10 months ago

Because control for Size Index I have created an index lifecycle policy and index template to manage it.

PUT _index_template/elastalert
{
  "priority": 100,
  "template": {
    "settings": {
      "index": {
        "lifecycle": {
          "name": "elastalert-policy"
        },
        "mapping": {
          "total_fields": {
            "limit": "10000"
          }
        },
        "refresh_interval": "5s",
        "number_of_replicas": "0"
      }
    },
    "mappings": {
      "dynamic_templates": [
        {
          "strings_as_keyword": {
            "mapping": {
              "ignore_above": 204800,
              "type": "text"
            }
          }
        }
      ]
    }
  },
  "index_patterns": [
    "elastalert*"
  ],
  "composed_of": [],
  "_meta": {
    "description": "index template for elastalert"
  }
}
PUT _index_template/elastalert
{
  "priority": 100,
  "template": {
    "settings": {
      "index": {
        "mapping": {
          "total_fields": {
            "limit": "10000"
          }
        },
        "refresh_interval": "5s",
        "number_of_replicas": "0"
      }
    },
    "mappings": {
      "dynamic_templates": [
        {
          "strings_as_keyword": {
            "mapping": {
              "ignore_above": 204800,
              "type": "text"
            }
          }
        }
      ]
    }
  },
  "index_patterns": [
    "elastalert*"
  ],
  "composed_of": [],
  "_meta": {
    "description": "index template for elastalert"
  }
}

But after index be delete by index lifecycle policy. elastalert can not re-create index in elasticsearch. I know manual execute run script elastalert-create-index in Elast Alert Service

image