การจัดการวงจรชีวิตดัชนี

Time-based data like logs and metrics keeps growing. Recent data is queried constantly; old data rarely. Index Lifecycle Management (ILM) automates moving indices through phases so you spend resources only where they matter.

ILM defines up to four phases:

• Hot: actively written and queried.
• Warm: no longer written, still queried.
• Cold: rarely queried, kept cheaply.
• Delete: removed.

In the hot phase, rollover starts a fresh index when the current one hits a size, document count, or age limit. This keeps individual shards a manageable size.

An ILM policy lists each phase and its min_age and actions. Here data moves to warm after 7 days and is deleted after 30.

In warm you can shrink the index to fewer shards, forcemerge segments for query efficiency, and move shards to cheaper warm nodes via allocation.

The cold phase can store data as searchable snapshots on object storage, drastically cutting cost while keeping it queryable. The frozen tier takes this even further for archival data.

A policy is linked to indices through an index template, so newly rolled-over indices inherit it automatically.

Data streams are the modern way to manage append-only time-series data with ILM. They hide rollover behind a single write alias, so you just index into the stream name.

Use the explain lifecycle API to see which phase each index is in and whether any step is stuck or errored.

ILM lets hot data live on fast SSD nodes while old data drifts to cheap storage and is eventually deleted automatically. This is the backbone of cost-effective, large-scale time-series clusters.

Roll over on size to keep shards near 30-50 GB, forcemerge only once writes stop, test policies on a sample index, and always pair ILM with snapshots for true backups (delete is permanent).

You learned to automate index aging:

• ILM moves indices through hot, warm, cold, and delete phases by age.
• Rollover keeps shards manageable; warm actions shrink and forcemerge.
• Cold/frozen tiers use searchable snapshots for cheap storage.
• Attach policies via templates, use data streams for time-series, and pair ILM with real snapshots.