1. The phases #
Data that ages.
Lifecycle #
| Phase | Typical actions | Nodes |
|---|---|---|
| hot | rollover, high priority | data_hot (SSD) |
| warm | shrink, forcemerge, read-only | data_warm |
| cold | fewer replicas, searchable snapshot (depending on license) | data_cold |
| frozen | partial searchable snapshot | data_frozen + object repository |
| delete | deletion, possibly after a snapshot | - |
2. A policy #
In practice.
Policy and diagnosis #
PUT _ilm/policy/logs-30d
{
"policy": {
"phases": {
"hot": { "actions": { "rollover": { "max_primary_shard_size": "50gb", "max_age": "1d" } } },
"warm": { "min_age": "7d", "actions": { "shrink": { "number_of_shards": 1 }, "forcemerge": { "max_num_segments": 1 } } },
"delete": { "min_age": "30d", "actions": { "delete": {} } }
}
}
}
GET logs-nginx-default/_ilm/explain # phase et étape de chaque index, erreurs éventuellesGood to know: min_age counts from the index rollover, not from its creation: a « 7-day » index in warm was written for 1 day and then aged 7 days.Common mistake: Without rollover, the age of a huge index does not change: ILM does nothing useful. Rollover (via a data stream or a write alias) is the foundation of everything else.
Good to know: Some features depend on the version and the license level (Basic, Platinum, Enterprise): check them in the documentation and on the Elastic subscriptions page before using them in production.
