Elasticsearch Index Rollover: An ILM Architecture Note for Time-Series Data
Rollover Elasticsearch time-series indices before shards oversize. Use ILM, verify with _ilm/explain, and keep primary shards near 20–40 GB.
ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Rollover Elasticsearch time-series indices before shards oversize. Use ILM, verify with _ilm/explain, and keep primary shards near 20–40 GB.
Use Elasticsearch ILM rollover to keep primary shards near a target size and automatically delete old time-series log indices.
Identify why Logstash throughput collapses when the persistent queue fills, verify disk and config causes, apply targeted fixes, and know when to escalate.
A practical diagnostic guide for Beats Connection Refused and publishing timeouts to Elasticsearch. Covers network checks, beats.yml validation, cluster health verification, and safe fixes with escalation criteria.
Learn how to use Elasticsearch Index Templates to automate shard settings and field mappings, ensuring consistency across time-series indices and preventing mapping explosions.
Mattermost search slows down as message history grows. Learn when to move search to Elasticsearch or OpenSearch and how to verify the cutover.
Compare Elasticsearch pagination methods for deep ordered reads: from/size, search_after with Point in Time, and Scroll API.
Learn how Kibana Spaces let teams isolate dashboards, visualizations, and searches, when they add value, how to set them up, and what limitations to watch for.
Learn how to diagnose and fix duplicate log ingestion in Filebeat by troubleshooting the registry state, offset tracking, and the close_inactive configuration.