What initiates the data rotation between buckets?

[jamesaarondevli]

Hi all,

which of the following initiates data rotation between buckets.

Is it the time from which the event is indexed or is it the timestamp attached to the event?

Cheers,
James

[Paolo_Prigione]

Hi James, neither of them if you talk about hot/warm buckets. Those are created and rotated solely based on the size and number of those already in these statuses.

• Older hot buckets are rolled to warm when they are more than maxHotBuckets, each as big as maxDataSize specifies (plus some other idle data rules...).
• Older warm buckets are rolled to cold when they are more than maxWarmDBCount.
• Older cold buckets are rolled to frozen when their latest event timestamp is older than frozenTimePeriodInSecs.
• Also, if the index grows more than maxTotalDataSizeMB, the oldest data is rolled to frozen.

Some more settings may be applied, please check the Index.conf docs for that.

Paolo