One day, I was studying the index life cycle function of kibana, and I felt that it was quite useful for our thousands of indexes. Before, I wrote a deletion script and put it in a scheduled task for deletion.

By creating a new life later strategy, setting the date on the 15th, and matching the index template to the test index, the next day, it was found that the index had no data. The index size was 283B and the number of documents was 0. It seems that data is not accepted.

By viewing the logs_server.json log of elasticsearch, the following error was found:

Through various search materials, we can see that from ES 7.0, Type is obsolete
in 7.0 and later versions. There is only one default type in an index, namely _doc.

It just so happens that when my colleague used logstash to output to elasticsearch, he defined a configuration item with document_type as log, decisively commented out the configuration item, restarted logstash, restarted elasticsearch, and found that the value of the _type column of the index content I tested was _ doc, the log displayed before should conflict with the default.

After that, the index can be generated with a normal number of documents, and the _type in the content is all _doc, as shown in the figure, it automatically returns to normal, there is normal data, wait to observe the life cycle policy effect, if the test index can be deleted normally, you can change The scope is extended to all indexes. .

Similar Posts:

• [923]ElasticSearch 7.4.2 Root mapping definition has unsupported parameters
• Oracle Script: How to Solve ‘unusable state index(ORA-01502)’
• [Solved] reason”: “Root mapping definition has unsupported parameters:
• [ Elasticsearch-PHP] No alive nodes found in your cluster in
• [Solved] elastic search, blocked by: index read-only/allow delete (api)
• [Solved] ElasticSearch Error: FORBIDDEN/12/index read-only/allow delete (api) ，read_only_allow_delete Set windows
• The ES query found 1024 elements and reported errors
• ERROR: Functions in index expression must be marked IMMUTABLE
• [How to Solve Eclipse Issue] Open type (Ctrl-Shift-T) Can Not Found
• [Solved] Docker Run ElasticSearch Error: docker: invalid reference format: repository name must be lowercase.