How to rollover indexes automatically using ISM policies in AWS OpenSearch

Introduction

OpenSearch is an open-source search and analytics suite, while Amazon OpenSearch Service is a managed service on Amazon Web Services that allows organizations to host and manage OpenSearch clusters in the cloud.

In this blog, we will discuss OpenSearch index automatic rollover using ISM policies, an issue faced by one of our clients, and how we successfully solved it.

Mafiree Field Story: Fixing 100 GB/day Rollover

One of our clients had an architecture where logs were pushed continuously from multiple servers and environments into an OpenSearch cluster using Fluent Bit.

Architecture Overview

Servers (multiple environments)
→ Fluent Bit log forwarder
→ AWS OpenSearch cluster

The first thing we noticed was that their indexes were growing at a rate of more than 100 GB per day. Logs were ingested from multiple development environments continuously, which made automatic index rollover mandatory for cluster stability.

The client attempted to implement an OpenSearch ISM rollover policy to automatically roll over indexes when the primary shard size reached a certain threshold. However, the rollover kept failing every time it triggered.

Why Index Rollover Matters (Cost, Scale, Stability)

Implementing OpenSearch automatic rollover is critical in log-heavy architectures.

Benefits include:

• Improved cluster stability
   
• Optimized shard sizes
   
• Reduced memory usage
   
• Faster search and indexing performance
   
• Lower storage and infrastructure cost
  
   

According to official OpenSearch recommendations, the optimal primary shard size should be between 30 GB and 50 GB.

Why?

Large shards require more memory and can lead to out-of-memory errors. Copy and recovery operations also become slower with oversized shards.

Maintaining optimal shard sizes significantly improves cluster performance.

ISM Fundamentals (Job Interval, Red Cluster Blocking)

ISM (Index State Management) policies control the lifecycle of an index.

An ISM policy in OpenSearch consists of:

• States
• Actions
• Transitions

Job Interval

The policy execution interval determines how frequently OpenSearch evaluates rollover conditions.

Red Cluster Blocking

If the cluster health becomes red, certain lifecycle operations like rollover can fail or be delayed.

Index Naming & Alias Patterns (Critical Gotchas)

One of the most common reasons OpenSearch index rollover fails is incorrect index naming.

For automatic rollover to work, the index name must follow this pattern:

^.*-\d+$

Example valid index names:

• mafiree-index-01
• mafiree-index-00001
• mafiree-001

This naming pattern allows OpenSearch to automatically generate the next sequential index name during rollover.

Setting Up Automatic Rollover (Step-by-Step)

Below is a simple OpenSearch index automatic rollover example using ISM policies.

Step 1 — Create an Index Template

An index template defines the general configuration applied to indexes that match a certain pattern.

Example:

PUT _index_template/mafiree-index-template
{
 "index_patterns": [
   "mafiree*"
 ],
 "template": {
   "settings": {
     "index.number_of_shards": "3",
     "index.number_of_replicas": "2"
   }
 },
 "composed_of": [],
 "priority": "100",
 "_meta": {
   "flow": "simple"
 }
}

This template applies the configuration to all indexes that match mafiree*.

Step 2 — Create an OpenSearch ISM Policy

An ISM policy defines lifecycle actions for indexes.

Example policy:

PUT _plugins/_ism/policies/mafiree-rollover-policy
{
 "policy": {
   "description": "ISM policy to keep the size of each primary shard optimal",
   "default_state": "rollover",
   "states": [
     {
       "name": "rollover",
       "actions": [
         {
           "rollover": {
             "min_primary_shard_size": "30gb"
           }
         }
       ],
       "transitions": []
     }
   ],
   "ism_template": {
     "index_patterns": ["mafiree*"],
     "priority": 100
   }
 }
}

This OpenSearch ISM rollover policy triggers rollover once the primary shard size reaches 30 GB.

Step 3 — Create the Index

You can create indexes via:

• OpenSearch Dashboard (GUI)
• Bulk API
• Log ingestion tools like Fluent Bit
• Ensure the index naming pattern is valid for rollover.

Step 4 — Create the Rollover Alias

In OpenSearch, an alias acts as a pointer to an index.

A rollover alias allows applications to write data without changing the index name after rollover.

Example:

POST /mafiree*/_alias/mafiree-rollover-alias

This alias routes requests to indexes matching mafiree*.

Step 5 — Add Rollover Alias to Index Template

Now we connect everything together.

PUT _index_template/mafiree-index-template
{
 "index_patterns": [
   "mafiree*"
 ],
 "template": {
   "settings": {
     "index.number_of_shards": "3",
     "index.number_of_replicas": "2",
     "index.plugins.index_state_management.rollover_alias": "mafiree-rollover-alias"
   }
 },
 "composed_of": [],
 "priority": "100",
 "_meta": {
   "flow": "simple"
 }
}

This setting ensures all indexes created through the template automatically use the rollover alias.

AWS OpenSearch Console Workflow

If you are using AWS OpenSearch, you can monitor rollover status from the dashboard.

Navigate to:

• Index Management → Indexes → Policy Managed Indexes
• Here you can view:
• ISM job status
• Policy execution state
• Rollover action progress

Troubleshooting: Why Your Rollover Isn't Working

Many users struggle with OpenSearch automatic rollover not triggering.

Common causes include:

1. Missing rollover alias

Error:

Missing rollover_alias index setting

Fix: Add

index.plugins.index_state_management.rollover_alias

to the index template.

2. Incorrect index naming pattern

If your index does not match:

^.*-\d+$

automatic rollover will fail.

3. Alias not set as write index

The alias must point to the current write index.

4. ISM policy not attached

Ensure the ISM policy is applied to the index pattern.

5. Rollover condition not met

Check if the shard size has actually crossed:

min_primary_shard_size

6. Cluster health issues

If cluster health is red, rollover actions may not execute.

Hot-Warm-Delete Lifecycle

A typical ISM lifecycle policy may include multiple phases:

This lifecycle helps reduce storage cost while maintaining performance.

Production Patterns & Anti-Patterns

Best practices for OpenSearch index rollover in production:

Recommended

• Keep shard sizes 30–50 GB
• Use rollover aliases
• Apply index templates
• Monitor ISM job execution

Avoid

• Creating too many shards
• Large shard sizes (>100 GB)
• Missing alias configurations
• Improper index naming 

Conclusion

By recreating the configuration in a controlled test environment, we were able to identify the missing pieces and properly implement OpenSearch index automatic rollover using ISM policies. After applying the correct index templates, ISM policies, naming patterns, and rollover alias configuration, the client’s OpenSearch cluster began rolling over indexes automatically without any failures. If you are facing similar challenges with your OpenSearch cluster, feel free to reach out to us at sales@mafiree.com. Our team can help you optimize your cluster, improve performance, and ensure smooth index lifecycle management.