How to Configure Index Lifecycle in Elasticsearch: Step-by-Step Guide

To configure index lifecycle in Elasticsearch, create an ILM policy defining phases like hot, warm, and delete, then attach this policy to an index template or directly to an index using the index.lifecycle.name setting. Elasticsearch will then automatically manage the index according to the defined lifecycle stages.

Syntax

An Index Lifecycle Management (ILM) policy in Elasticsearch defines phases and actions for index management. The main parts are:

• phases: Define lifecycle stages like hot, warm, cold, and delete.
• actions: Specify what happens in each phase, such as rollover, forcemerge, shrink, or delete.
• min_age: Time to wait before moving to the next phase.

You then apply the policy to an index by setting index.lifecycle.name in the index settings or via an index template.

json

{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "30d"
          }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

Example

This example creates an ILM policy named my_policy with a hot phase that rolls over the index after 50GB or 30 days, and a delete phase that removes the index after 90 days. Then it creates an index template that applies this policy to new indices starting with logs-.

json

PUT _ilm/policy/my_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "30d"
          }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

PUT _index_template/logs_template
{
  "index_patterns": ["logs-*"] ,
  "template": {
    "settings": {
      "index.lifecycle.name": "my_policy",
      "index.lifecycle.rollover_alias": "logs_alias"
    },
    "aliases": {
      "logs_alias": {}
    }
  }
}

PUT logs-000001
{
  "aliases": {
    "logs_alias": {
      "is_write_index": true
    }
  }
}

Output

{
  "acknowledged": true
}
{
  "acknowledged": true
}
{
  "acknowledged": true,
  "shards_acknowledged": true,
  "index": "logs-000001"
}

Common Pitfalls

• Not setting index.lifecycle.rollover_alias when using rollover action causes errors because rollover needs an alias.
• Applying ILM policy to existing indices without proper alias setup will not trigger rollover.
• Forgetting to create the initial index with the write alias is_write_index set to true prevents rollover.
• Setting incorrect min_age values can cause unexpected phase transitions.

json

Wrong:
PUT logs-000001
{
  "aliases": {
    "logs_alias": {}
  }
}

Right:
PUT logs-000001
{
  "aliases": {
    "logs_alias": {
      "is_write_index": true
    }
  }
}

Quick Reference

Term	Description
ILM Policy	Defines phases and actions for index lifecycle management.
Phases	Stages like hot, warm, cold, delete to manage index over time.
Actions	Operations like rollover, forcemerge, shrink, delete in phases.
Rollover Alias	Alias used to point to the current write index for rollover.
min_age	Minimum time before moving to the next phase.

Key Takeaways

Create an ILM policy with phases and actions to automate index management.

Attach the ILM policy to indices via index templates or index settings.

Always set a rollover alias and create the initial index with is_write_index true for rollover.

Use min_age to control when phases transition in the lifecycle.

Test your ILM policy on test indices before applying to production.