wazuh-packages icon indicating copy to clipboard operation
wazuh-packages copied to clipboard

Wazuh Indexer ISM: The existent index does not updates the policy modification

Open dariommr opened this issue 2 years ago • 0 comments

Wazuh version Install type Action performed Platform
4.3.0-rc6 Indexer Install Any

Rationale

When editing an existing ISM policy, the changes are not applied to the managed indices.

Steps to reproduce

1. Create Policy

image

image

image

image

  • The policy is applied to the wazuh-alerts-* index pattern, so every new index should be managed by this policy.

image

image

image

  • The policy was created for 30 days in hot storage, 365 days in cold storage, then delete the index.
2. Apply the policy to the current indices

image

image

3. Check the managed indices

image

4. Edit the Policy

image

image

  • Configured in 1d for hot and 2d for cold in order to check soon about the transitions

image

5. Check the index state transition

image

  • We can see the newer index was created with the policy applied, but it seems the index from the previous day is still in hot, and should be in cold state.

  • Checking the index date

image

image

The first index (an already existent index) failed to apply the transitions after the policy modification: image

Expected results

After modifying the ISM policy, the transitions for the existent indices (not only for the newly created ones) should be applied as expected, but it seems it is not, it still conserves the previous configuration.

Thank you in advance!

dariommr avatar May 05 '22 14:05 dariommr