Index Lifecycle Management (ILM)

Time-series data like logs grows endlessly. Index Lifecycle Management (ILM) automates moving, shrinking, and deleting indices so old data does not crush your cluster.

Rollover creates a new index when the current one hits a size, age, or document count threshold. Writes always go to a single alias.

Apps write to an alias such as logs-write. ILM swaps which physical index the alias points to on rollover, invisible to the writer.

ILM defines lifecycle phases a data ages through.

• Hot: actively written and queried
• Warm: read-only, queried less
• Cold: rarely queried, cheap storage
• Delete: removed

The hot phase lives on the fastest nodes with the most resources, handling all writes and recent queries.

In warm, indices become read-only and may move to cheaper nodes. You can shrink shards and force-merge segments to save space.

Cold data moves to the cheapest disks; frozen can be searched directly from object storage. Both trade query speed for cost.

The delete phase enforces retention by removing indices past a chosen age, the simplest way to cap storage growth.

An index template binds new indices to an ILM policy and the write alias automatically.

Hot-warm-cold relies on node attributes so allocation actions can route shards to the right hardware tier.

A typical logging policy: roll over daily in hot, move to warm and force-merge after a week, go cold after a month, and delete after ninety days.

You learned how ILM automates index management: rollover starts fresh indices behind a write alias, and the hot-warm-cold-delete phases move data to cheaper tiers as it ages and finally remove it. Index templates bind policies automatically, keeping clusters fast and storage bounded.