This tutorial demonstrates how to use index lifecycle management (ILM) to manage indices that contain time-series data.

When you continuously index timestamped documents into Elasticsearch, you typically use an index alias so you can periodically roll over to a new index. This enables you to implement a hot-warm-cold architecture to meet your performance requirements for your newest data, control costs over time, enforce retention policies, and still get the most out of your data.

To automate rollover and management of time-series indices with ILM, you:

For an introduction to rolling indices, see Rollover.

Create a lifecycle policyedit

A lifecycle policy specifies the phases in the index lifecycle and the actions to perform in each phase. A lifecycle can have up to four phases: hot, warm, cold, and delete.

You can define and manage policies through Kibana Management or with the put policy API.

For example, you might define a timeseries_policy that has two phases:

The underlying put policy request looks like this:

PUT _ilm/policy/datastream_policy
{
  "policy": {
    "phases": {
      "hot": {                      
        "actions": {
          "rollover": {
            "max_size": "50GB",     
            "max_age": "30d"
          }
        }
      },
      "delete": {
        "min_age": "90d",           
        "actions": {
          "delete": {}              
        }
      }
    }
  }
}

You can also invoke this API directly to add lifecycle policies.

For the complete list of actions that index lifecycle management can perform, see Index lifecycle actions.

Create an index template to apply the lifecycle policyedit

To automatically apply a lifecycle policy to the new write index on rollover, specify the policy in the index template used to create new indices.

For example, you might create a timeseries_template that is applied to new indices whose names match the timeseries-* index pattern.

To enable automatic rollover, the template configures two ILM settings:

You can use the Kibana Create template wizard to add the template. This wizard invokes the put template API to create the template with the options you specify.

The underlying request looks like this:

PUT _template/datastream_template
{
  "index_patterns": ["datastream-*"],                 
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1,
    "index.lifecycle.name": "datastream_policy",      
    "index.lifecycle.rollover_alias": "datastream"    
  }
}

You can also invoke this API directly to add templates.

Bootstrap the initial time-series indexedit

To get things started, you need to bootstrap an initial index and designate it as the write index for the rollover alias specified in your index template. The name of this index must match the template’s index pattern and end with a number. On rollover, this value is incremented to generate a name for the new index.

For example, the following request creates an index called datastream-000001 and makes it the write index for the datastream alias.

PUT datastream-000001
{
  "aliases": {
    "datastream": {
      "is_write_index": true
    }
  }
}

When the rollover conditions are met, the rollover action:

This process repeats each time rollover conditions are met. You can search across all of the indices managed by the datastream_policy with the datastream alias. Write operations are routed to the current write index.

Check lifecycle progressedit

To get status information for managed indices, you use the ILM explain API. This lets you find out things like:

For example, the following request gets information about the datastream indices:

GET datastream-*/_ilm/explain

The response below shows that the bootstrap index is waiting in the hot phase’s rollover action. It remains in this state and ILM continues to call attempt-rollover until the rollover conditions are met.

{
  "indices": {
    "datastream-000001": {
      "index": "datastream-000001",
      "managed": true,
      "policy": "datastream_policy",             
      "lifecycle_date_millis": 1538475653281,
      "age": "30s",                              
      "phase": "hot",
      "phase_time_millis": 1538475653317,
      "action": "rollover",
      "action_time_millis": 1538475653317,
      "step": "attempt-rollover",                
      "step_time_millis": 1538475653317,
      "phase_execution": {
        "policy": "datastream_policy",
        "phase_definition": {                    
          "min_age": "0ms",
          "actions": {
            "rollover": {
              "max_size": "50gb",
              "max_age": "30d"
            }
          }
        },
        "version": 1,
        "modified_date_in_millis": 1539609701576
      }
    }
  }
}