With the current default Index Management Policy, the index will get a rollover when primary_shard_size reaches 20 GB. In case of high-flow-volume installs, the user should not see problems, as the index will be created as soon as the volume reaches 20 GB.
However, in the case of low-flow-volume installs, the index never gets rollover, i.e., there is only one index being used for days, and then after 7 days the index will be deleted because “7d” is reached, and the new index will be created from scratch with empty data.
Current default Index Management Policy:
"actions": [{
"rollover": {
"min_primary_shard_size": "20gb",
..snip..
"transitions": [{
"state_name": "delete",
"conditions": {
"min_index_age": "7d"
Workaround:
In case of low-flow volume installs, it is recommended to add “24h” as min_index_age for rollover action so that Index will rollover daily basis even if the flow volume has not reached 20 GB. In one week, 7 indexes will be created and the oldest one who reached “7d” will be deleted, but the other 6 indexes will remain.
"min_index_age": "24h", <———— add this