Index lifecycle management in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a policy that deletes an index after 30 days.

Elasticsearch

{
  "policy": {
    "phases": {
      "delete": {
        "min_age": "[1]",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A30d

B30m

C30s

D30w

Attempts:

3 left

💡 Hint

Common Mistakes

Using minutes or seconds instead of days.

Forgetting to specify the time unit.

The min_age value specifies how long the index should live before the delete action runs. 30d means 30 days.

2fill in blank

medium

Complete the code to add a rollover action when the index reaches 50GB.

Elasticsearch

{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "[1]"
          }
        }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A50mb

B50tb

C50kb

D50gb

Attempts:

3 left

💡 Hint

Common Mistakes

Using lowercase 'mb' instead of 'gb'.

Confusing size units like kb or tb.

The max_size in rollover defines the maximum index size before rollover. 50gb means 50 gigabytes.

3fill in blank

hard

Fix the error in the policy that tries to move an index to warm phase after 10 days.

Elasticsearch

{
  "policy": {
    "phases": {
      "warm": {
        "min_age": "[1]",
        "actions": {
          "allocate": {
            "number_of_replicas": 2
          }
        }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A10d

B10h

C10m

D10s

Attempts:

3 left

💡 Hint

Common Mistakes

Using hours, minutes, or seconds instead of days.

Omitting the time unit.

The min_age must be specified with a time unit. 10d means 10 days, which is correct for moving to warm phase after 10 days.

4fill in blank

hard

Fill both blanks to create a policy that moves an index to cold phase after 20 days and freezes it.

Elasticsearch

{
  "policy": {
    "phases": {
      "cold": {
        "min_age": "[1]",
        "actions": {
          "[2]": {}
        }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A20d

Bfreeze

Cdelete

Drollover

Attempts:

3 left

💡 Hint

Common Mistakes

Using delete or rollover actions in cold phase incorrectly.

Wrong time unit for min_age.

The min_age is set to 20d to start cold phase after 20 days. The freeze action freezes the index to save resources.

5fill in blank

hard

Fill all three blanks to define a policy with hot phase rollover at 25GB, warm phase after 7 days with 1 replica, and delete phase after 90 days.

Elasticsearch

{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "[1]"
          }
        }
      },
      "warm": {
        "min_age": "[2]",
        "actions": {
          "allocate": {
            "number_of_replicas": [3]
          }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A25gb

B7d

C1

D90d

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up time units or numbers.

Using wrong values for replicas.

The hot phase rolls over at 25gb. The warm phase starts after 7d with 1 replica. The delete phase removes the index after 90 days.

Practice

1. What is the main purpose of Index Lifecycle Management (ILM) in Elasticsearch?

easy

A. To automate index handling and improve cluster performance

B. To manually create indexes for each data type

C. To backup data to external storage

D. To encrypt index data for security

Solution

1. Step 1: Understand ILM's role

   ILM automates managing indexes through their lifecycle phases.

2. Step 2: Identify the benefit

   Automation helps save space and improves cluster health and performance.

3. Final Answer:

   To automate index handling and improve cluster performance -> Option A

4. Quick Check:

   ILM automates index management = A [OK]

Hint: ILM automates index tasks to keep Elasticsearch healthy [OK]

Common Mistakes:

• Thinking ILM is for manual index creation
• Confusing ILM with backup or encryption
• Assuming ILM only deletes indexes

2. Which of the following is the correct way to define a rollover action in an ILM policy JSON?

easy

A. "rollover": { "max_size": "50gb", "max_age": "30d" }

B. "rollover": "true"

C. "rollover": { "size": "50gb" }

D. "rollover": { "max_documents": 1000 }

Solution

1. Step 1: Check rollover action syntax

   Rollover requires conditions like max_size and max_age in a JSON object.

2. Step 2: Validate options

   "rollover": { "max_size": "50gb", "max_age": "30d" } correctly uses max_size and max_age keys with proper values.

3. Final Answer:

   "rollover": { "max_size": "50gb", "max_age": "30d" } -> Option A

4. Quick Check:

   Rollover needs max_size and max_age keys = A [OK]

Hint: Rollover needs max_size and max_age keys in JSON [OK]

Common Mistakes:

• Using string 'true' instead of object for rollover
• Missing max_age or max_size keys
• Using incorrect key names like 'size'

3. Given this ILM policy snippet:

{"phases": {"hot": {"actions": {"rollover": {"max_size": "10gb"}}}, "delete": {"min_age": "90d", "actions": {"delete": {}}}}}

What happens to an index after it reaches 10GB?

medium

A. It archives data to external storage

B. It rolls over to a new index and continues indexing

C. It stops accepting new data but stays

D. It is immediately deleted

Solution

1. Step 1: Analyze rollover action in hot phase

   The policy rolls over the index when it reaches 10GB.

2. Step 2: Understand delete phase timing

   Deletion happens only after 90 days, so not immediate.

3. Final Answer:

   It rolls over to a new index and continues indexing -> Option B

4. Quick Check:

   Rollover at 10GB, delete after 90d = D [OK]

Hint: Rollover triggers at size, delete waits min_age [OK]

Common Mistakes:

• Confusing rollover with immediate deletion
• Ignoring min_age delay for delete phase
• Assuming data stops indexing after rollover

4. You have this ILM policy JSON:

{"phases": {"hot": {"actions": {"rollover": {"max_size": "20gb"}}}, "warm": {"min_age": "10d", "actions": {"shrink": {"number_of_shards": 1}}}}}

After applying, the shrink action never runs. What is the likely cause?

medium

A. Rollover max_size is too small

B. Shrink action requires delete phase

C. Shrink action must be in hot phase

D. The index has not reached 10 days old yet

Solution

1. Step 1: Check warm phase min_age

   Shrink runs only after index is at least 10 days old.

2. Step 2: Confirm index age

   If index age is less than 10 days, shrink won't trigger yet.

3. Final Answer:

   The index has not reached 10 days old yet -> Option D

4. Quick Check:

   min_age controls action timing = C [OK]

Hint: Check min_age before expecting warm phase actions [OK]

Common Mistakes:

• Assuming shrink needs delete phase
• Changing rollover size unrelated to shrink
• Placing shrink in wrong phase

5. You want to create an ILM policy that:
- Rolls over an index at 30GB or 15 days
- Moves the index to warm phase after rollover
- Deletes the index 60 days after rollover

Which policy configuration correctly implements this?

hard

A. {"phases": {"hot": {"actions": {"rollover": {"max_size": "30gb"}}}, "warm": {"min_age": "30d", "actions": {}}, "delete": {"min_age": "60d", "actions": {"delete": {}}}}}

B. {"phases": {"hot": {"actions": {"rollover": {"max_age": "15d"}}}, "warm": {"min_age": "15d", "actions": {"shrink": {}}}, "delete": {"min_age": "60d", "actions": {"delete": {}}}}}

C. {"phases": {"hot": {"actions": {"rollover": {"max_size": "30gb", "max_age": "15d"}}}, "warm": {"min_age": "15d", "actions": {}}, "delete": {"min_age": "60d", "actions": {"delete": {}}}}}

D. {"phases": {"hot": {"actions": {"rollover": {"max_size": "15gb", "max_age": "30d"}}}, "warm": {"min_age": "15d", "actions": {}}, "delete": {"min_age": "60d", "actions": {"delete": {}}}}}

Solution

1. Step 1: Verify rollover conditions

   {"phases": {"hot": {"actions": {"rollover": {"max_size": "30gb", "max_age": "15d"}}}, "warm": {"min_age": "15d", "actions": {}}, "delete": {"min_age": "60d", "actions": {"delete": {}}}}} uses max_size 30gb and max_age 15d, matching requirements.

2. Step 2: Check warm and delete phases

   Warm phase starts at 15d (after rollover), delete at 60d, as required.

3. Step 3: Confirm other options

   Other options have wrong sizes, ages, or missing actions.

4. Final Answer:

   {"phases": {"hot": {"actions": {"rollover": {"max_size": "30gb", "max_age": "15d"}}}, "warm": {"min_age": "15d", "actions": {}}, "delete": {"min_age": "60d", "actions": {"delete": {}}}}} -> Option C

5. Quick Check:

   Rollover at 30gb/15d, warm at 15d, delete at 60d = B [OK]

Hint: Match rollover size and age, then warm and delete min_age [OK]

Common Mistakes:

• Swapping max_size and max_age values
• Setting warm min_age too late
• Missing delete action or wrong min_age