Index Settings #

All monitoring metrics of INFINI Console are stored in the Elasticsearch index. As time goes by, the data will increase. We can configure the life cycle of the index to adapt to our monitoring storage requirements.

Configure the Default Index Template #

Then you can configure the index template of the Elasticsearch cluster, and execute the following command on the system monitoring cluster to create the index template.

Expand to see Elasticsearch template definitions ...

PUT _template/.infini
{
    "order": 0,
    "index_patterns": [
      ".infini_*"
    ],
    "settings": {
      "index": {
        "max_result_window": "10000000",
        "mapping": {
          "total_fields": {
            "limit": "20000"
          }
        },
        "analysis": {
          "analyzer": {
            "suggest_text_search": {
              "filter": [
                "word_delimiter"
              ],
              "tokenizer": "classic"
            }
          }
        },
        "number_of_shards": "1"
      }
    },
    "mappings": {
      "dynamic_templates": [
        {
          "strings": {
            "mapping": {
              "ignore_above": 256,
              "type": "keyword"
            },
            "match_mapping_type": "string"
          }
        }
      ]
    },
    "aliases": {}
}

Configure ILM for index .infini_metrics #

Expand to view settings ...

PUT _ilm/policy/infini_metrics-30days-retention
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_age": "30d",
            "max_size": "50gb"
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "delete": {
        "min_age": "30d",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": true
          }
        }
      }
    }
  }
}

PUT _template/.infini_metrics-rollover
{
    "order" : 100000,
    "index_patterns" : [
      ".infini_metrics*"
    ],
    "settings" : {
      "index" : {
        "format" : "7",
        "lifecycle" : {
          "name" : "infini_metrics-30days-retention",
          "rollover_alias" : ".infini_metrics"
        },
        "codec" : "best_compression",
        "number_of_shards" : "1",
        "translog.durability":"async"
      }
    },
    "mappings" : {
      "dynamic_templates" : [
        {
          "strings" : {
            "mapping" : {
              "ignore_above" : 256,
              "type" : "keyword"
            },
            "match_mapping_type" : "string"
          }
        }
      ]
    },
    "aliases" : { }
  }


# delete old index
DELETE .infini_metrics   
DELETE .infini_metrics-00001
PUT .infini_metrics-00001
{
  "settings": {
    "index.lifecycle.rollover_alias":".infini_metrics"
    , "refresh_interval": "5s"
  },
  "aliases":{
    ".infini_metrics":{
      "is_write_index":true
    }
  }
}

If the index .infini_metrics already exists before, it needs to be deleted first.

Configure ILM for index .infini_alert-history #

The alert module stores a large amount of index data for execution records, so you need to configure ILM as follows:

Expand to view settings ...

PUT _template/.infini_alert-history-rollover
{
    "order" : 100000,
    "index_patterns" : [
      ".infini_alert-history*"
    ],
    "settings" : {
      "index" : {
        "format" : "7",
        "lifecycle" : {
          "name" : "infini_metrics-30days-retention",
          "rollover_alias" : ".infini_alert-history"
        },
        "codec" : "best_compression",
        "number_of_shards" : "1",
        "translog.durability":"async"
      }
    },
    "mappings" : {
      "dynamic_templates" : [
        {
          "strings" : {
            "mapping" : {
              "ignore_above" : 256,
              "type" : "keyword"
            },
            "match_mapping_type" : "string"
          }
        }
      ]
    },
    "aliases" : { }
  }

DELETE .infini_alert-history

DELETE .infini_alert-history-00001
PUT .infini_alert-history-00001
{
  "settings": {
    "index.lifecycle.rollover_alias":".infini_alert-history"
    , "refresh_interval": "5s"
  },
  "aliases":{
    ".infini_alert-history":{
      "is_write_index":true
    }
  },
  "mappings": {
    "properties" : {
        "condition" : {
          "properties" : {
            "items" : {
              "properties" : {
                "expression" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                },
                "minimum_period_match" : {
                  "type" : "long"
                },
                "operator" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                },
                "severity" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                },
                "values" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "operator" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "condition_result" : {
          "type" : "object",
          "enabled" : false
        },
        "context" : {
          "type" : "keyword",
          "copy_to" : [
            "search_text"
          ]
        },
        "created" : {
          "type" : "date"
        },
        "expression" : {
          "type" : "keyword",
          "copy_to" : [
            "search_text"
          ]
        },
        "id" : {
          "type" : "keyword"
        },
        "is_escalated" : {
          "type" : "boolean"
        },
        "is_notified" : {
          "type" : "boolean"
        },
        "message" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "objects" : {
          "type" : "keyword",
          "copy_to" : [
            "search_text"
          ]
        },
        "resource_id" : {
          "type" : "keyword"
        },
        "resource_name" : {
          "type" : "keyword"
        },
        "rule_id" : {
          "type" : "keyword"
        },
        "rule_name" : {
          "type" : "keyword"
        },
        "search_text" : {
          "type" : "text",
          "analyzer" : "suggest_text_search",
          "index_prefixes" : {
            "min_chars" : 2,
            "max_chars" : 5
          },
          "index_phrases" : true
        },
        "severity" : {
          "type" : "keyword"
        },
        "state" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "title" : {
          "type" : "keyword"
        },
        "updated" : {
          "type" : "date"
        }
      }
    }
}

Configure ILM for index .infini_activities #

Expand to view settings ...

PUT _template/.infini_activities-rollover
{
    "order" : 100000,
    "index_patterns" : [
      ".infini_activities*"
    ],
    "settings" : {
      "index" : {
        "format" : "7",
        "lifecycle" : {
          "name" : "infini_metrics-30days-retention",
          "rollover_alias" : ".infini_activities"
        },
        "codec" : "best_compression",
        "number_of_shards" : "1",
        "translog.durability":"async"
      }
    },
    "mappings" : {
      "dynamic_templates" : [
        {
          "strings" : {
            "mapping" : {
              "ignore_above" : 256,
              "type" : "keyword"
            },
            "match_mapping_type" : "string"
          }
        }
      ]
    },
    "aliases" : { }
  }

  DELETE .infini_activities
  DELETE .infini_activities-00001

  PUT .infini_activities-00001
  {
    "settings": {
      "index.lifecycle.rollover_alias":".infini_activities"
      , "refresh_interval": "5s"
    },
    "aliases":{
      ".infini_activities":{
        "is_write_index":true
      }
    }
  }