定义 ILM 策略、通过模板关联并引导 rollover 链

命令

PUT _ilm/policy/log-policy
{
  "policy": {
    "phases": {
      "hot": { "actions": { "rollover": { "max_primary_shard_size": "50gb", "max_age": "1d" }, "set_priority": { "priority": 100 } } },
      "warm": { "min_age": "7d", "actions": { "shrink": { "number_of_shards": 1 }, "forcemerge": { "max_num_segments": 1 }, "set_priority": { "priority": 50 } } },
      "delete": { "min_age": "30d", "actions": { "delete": {} } }
    }
  }
}
PUT _index_template/log
{
  "index_patterns": ["log-*"],
  "priority": 500,
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1,
      "index.lifecycle.name": "log-policy",
      "index.lifecycle.rollover_alias": "log"
    }
  }
}
# Create the first index with the write alias (its name must end with a number such as -000001):
PUT log-000001
{
  "aliases": { "log": { "is_write_index": true } }
}

作用

创建包含 hot（rollover）、warm（shrink + force merge）和 delete 阶段的 ILM 策略，通过模板将策略和 rollover 别名应用到新索引，并创建带写入别名的链中第一个索引。

适用场景

为日志或指标等时序数据自动管理索引大小、保留和删除时。

注意

warm 和 delete 阶段的 min_age 从 rollover 时间开始计算，而不是从索引创建时间。策略变更只有在现有索引的当前阶段完成后才对其生效。warm 阶段的 shrink 和 forcemerge 会产生大量 IO；在 force merge 完成前不得写入该索引。ILM 默认每 10 分钟运行一次，因此条件不会被即时评估。