0Pricing
Elasticsearch & Full Text Search Systems · Lesson

Index Lifecycle Management

Automate the aging of indices through hot, warm, cold, and delete phases with ILM policies to control cost and performance at scale.

Index Lifecycle Management is a free Elasticsearch & Full Text Search Systems lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Elasticsearch & Full Text Search Systems learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Data Gets Old

Time-based data like logs and metrics keeps growing. Recent data is queried constantly; old data rarely. Index Lifecycle Management (ILM) automates moving indices through phases so you spend resources only where they matter.

The Four Phases

ILM defines up to four phases:

  • Hot: actively written and queried.
  • Warm: no longer written, still queried.
  • Cold: rarely queried, kept cheaply.
  • Delete: removed.

Rollover

In the hot phase, rollover starts a fresh index when the current one hits a size, document count, or age limit. This keeps individual shards a manageable size.

"rollover": {
  "max_size": "50gb",
  "max_age": "7d"
}

Defining a Policy

An ILM policy lists each phase and its min_age and actions. Here data moves to warm after 7 days and is deleted after 30.

PUT _ilm/policy/logs_policy
{
  "policy": { "phases": {
    "hot":  { "actions": { "rollover": { "max_age": "1d" } } },
    "warm": { "min_age": "7d",  "actions": {} },
    "delete": { "min_age": "30d", "actions": { "delete": {} } }
  }}
}

Warm Phase Actions

In warm you can shrink the index to fewer shards, forcemerge segments for query efficiency, and move shards to cheaper warm nodes via allocation.

"warm": {
  "actions": {
    "forcemerge": { "max_num_segments": 1 },
    "shrink": { "number_of_shards": 1 }
  }
}

Cold and Frozen

The cold phase can store data as searchable snapshots on object storage, drastically cutting cost while keeping it queryable. The frozen tier takes this even further for archival data.

Attaching to an Index

A policy is linked to indices through an index template, so newly rolled-over indices inherit it automatically.

PUT _index_template/logs_template
{
  "index_patterns": ["logs-*"],
  "template": { "settings": {
    "index.lifecycle.name": "logs_policy"
  }}
}

Data Streams

Data streams are the modern way to manage append-only time-series data with ILM. They hide rollover behind a single write alias, so you just index into the stream name.

Monitoring ILM

Use the explain lifecycle API to see which phase each index is in and whether any step is stuck or errored.

GET logs-*/_ilm/explain

Cost and Performance Wins

ILM lets hot data live on fast SSD nodes while old data drifts to cheap storage and is eventually deleted automatically. This is the backbone of cost-effective, large-scale time-series clusters.

Best Practices

Roll over on size to keep shards near 30-50 GB, forcemerge only once writes stop, test policies on a sample index, and always pair ILM with snapshots for true backups (delete is permanent).

Quick Check

Test your understanding of ILM.

Recap

You learned to automate index aging:

  • ILM moves indices through hot, warm, cold, and delete phases by age.
  • Rollover keeps shards manageable; warm actions shrink and forcemerge.
  • Cold/frozen tiers use searchable snapshots for cheap storage.
  • Attach policies via templates, use data streams for time-series, and pair ILM with real snapshots.

Frequently asked questions

Is the “Index Lifecycle Management” lesson free?

Yes — the full text of “Index Lifecycle Management” is free to read here on the web, and the Elasticsearch & Full Text Search Systems course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Elasticsearch & Full Text Search Systems course, upgrade to CoddyKit PRO.

What will I learn in “Index Lifecycle Management”?

Automate the aging of indices through hot, warm, cold, and delete phases with ILM policies to control cost and performance at scale. You practise Elasticsearch & Full Text Search Systems with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Elasticsearch & Full Text Search Systems?

No prior experience is required. Elasticsearch & Full Text Search Systems on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Index Lifecycle Management” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Elasticsearch & Full Text Search Systems lesson?

Yes. Every Elasticsearch & Full Text Search Systems lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Geospatial Search Capabilities
  2. Time-Series Data Management
  3. Production Deployment Strategies
  4. Index Lifecycle Management
← Back to Elasticsearch & Full Text Search Systems