Transitioning index based on index time based pattern instead of index age

[yogevyuval]

Hi,
Our indices names are time based, and are using the @timestamp of the events to determine the correct index. For example, data from 3.4.2021, will be indexed into an index named events-3.4.2021.

We want to use ISM to move that index into cold storage after 30d, but it seems it’s only possible to do that based on the index age. Index age is not suitable for us, since it uses the time of index, and not the actual time of the events (the index name).

Elastic allows you to define index.lifecycle.origination_date, so that the “index age” is actually based on a regex pattern in the index name. Is it possible to do something similar in OpenSearch?

[BlackMetalz]

@yogevyuval

We want to use ISM to move that index into cold storage after 30d, but it seems it’s only possible to do that based on the index age. Index age is not suitable for us, since it uses the time of index, and not the actual time of the events (the index name).

Elastic allows you to define index.lifecycle.origination_date, so that the “index age” is actually based on a regex pattern in the index name. Is it possible to do something similar in OpenSearch?

It is not possible right now in OpenSearch document I guess:

Policies

Btw, you can increase index age for a workaround