Index lifecycle management in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What is the output of this ILM policy status query?

Given an index named logs-2023.06 managed by an ILM policy, what will be the phase shown in the output after the index has been rolled over and is currently in the warm phase?

Elasticsearch

GET logs-2023.06/_ilm/explain

A {"indices":{"logs-2023.06":{"index":"logs-2023.06","managed":true,"policy":"logs_policy","phase":"warm","action":"complete","step":"complete"}}}

B {"indices":{"logs-2023.06":{"index":"logs-2023.06","managed":true,"policy":"logs_policy","phase":"hot","action":"rollover","step":"check-rollover-ready"}}}

C {"indices":{"logs-2023.06":{"index":"logs-2023.06","managed":true,"policy":"logs_policy","phase":"delete","action":"wait-for-shard-history-leases","step":"wait-for-shard-history-leases"}}}

D {"indices":{"logs-2023.06":{"index":"logs-2023.06","managed":false}}}

💡 Hint

Think about what phase comes after rollover in a typical ILM policy.

After rollover, the index moves from the hot phase to the warm phase. The ILM explain API shows the current phase and step for the index.

🧠 Conceptual

intermediate

Which ILM phase is best for reducing index shard size without deleting data?

In Index Lifecycle Management, which phase is typically used to reduce shard size by shrinking or force merging indices, while keeping the data available?

A Cold phase

B Warm phase

C Hot phase

D Delete phase

💡 Hint

This phase is after hot and before cold, focusing on optimizing storage.

The warm phase is used to optimize indices by shrinking or force merging to reduce shard size while keeping data accessible.

📝 Syntax

advanced

Which ILM policy JSON snippet correctly defines a delete phase after 30 days?

Select the correct JSON snippet that defines a delete phase in an ILM policy to delete indices after 30 days.

A { "delete": { "min_age": "30d", "actions": { "remove": {} } } }

B { "delete": { "min_age": 30, "actions": { "delete": {} } } }

C { "delete": { "min_age": "30", "actions": { "remove": {} } } }

D { "delete": { "min_age": "30d", "actions": { "delete": {} } } }

💡 Hint

The min_age must be a string with time unit, and the action to delete is named 'delete'.

The correct syntax uses a string with 'd' for days and the action key 'delete' to remove indices.

❓ optimization

advanced

How to optimize ILM policy to reduce disk usage quickly after rollover?

You want to reduce disk usage as soon as possible after rollover. Which ILM phase action should you add immediately after rollover to optimize storage?

A Add a force_merge action in the warm phase

B Add a shrink action in the hot phase

C Add a freeze action in the cold phase

D Add a delete action in the warm phase

💡 Hint

Force merge reduces segment count and disk usage without deleting data.

Force merge in the warm phase reduces disk usage by merging index segments after rollover.

🔧 Debug

expert

Why does this ILM policy fail to delete indices after 30 days?

An ILM policy has this delete phase snippet: { "delete": { "min_age": "30d", "actions": { "remove": {} } } } Why does the index not get deleted after 30 days?

A The min_age should be an integer, not a string.

B The delete phase must be named 'delete_phase', not 'delete'.

C The action 'remove' is invalid; it should be 'delete'.

D The policy must include a rollover action before delete.

💡 Hint

Check the action names supported by ILM for deleting indices.

The correct action to delete indices is 'delete', not 'remove'. Using 'remove' causes the delete phase to be ignored.