Unexpected rolling over indices in RHOCP 4

Solution Verified - Updated -

Issue

  • New empty indices (audit, app, infra) are created without fulfilling the index management cronjob roll-over conditions.

    $ oc exec -n openshift-logging -c elasticsearch $es_pod -- es_util --query=_cat/indices?v
    health status index        uuid                   pri rep docs.count docs.deleted store.size pri.store.size
    green  open   app-000001   5oA5aoOzQuuTZod6AyP6cw   1   0        119            0    216.3kb        216.3kb
    green  open   .security    PP8U8rGTTV-H4IJUsltsmg   1   0          6            0     33.2kb         33.2kb
    green  open   infra-000001 mdiyyrYCQUmCuUWF4f_MCA   1   0          0            0       261b           261b
    green  open   .kibana_1    m1LJ3pWFQxeW56bhdCCzGQ   1   0          0            0       261b           261b
    green  open   app-000002   r1qc1skYSPGlP-noNiPjqA   1   0          0            0       261b           261b  -->new empty index
    green  open   audit-000002 EbUGAFv5TMKqRhu2GY8C-Q   1   0          0            0       261b           261b  -->new empty index 
    green  open   infra-000002 JBvjHyTkSse0C9alXEsmgA   1   0          0            0       261b           261b  -->new empty index 
    green  open   audit-000001 TENxomASTPWZT3-UCbhsTg   1   0          0            0       261b           261b
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4
  • Red Hat Openshift Logging (RHOL)
    • 5

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content