ILM 索引生命周期管理

本章定位：ILM（Index Lifecycle Management）自动管理索引从创建到删除的全生命周期。是生产环境日志/指标系统的标配能力。

定义与作用

ILM 定义了索引在 Hot（热）、Warm（温）、Cold（冷）、Delete（删除）四个阶段的自动流转规则。每个阶段可以执行不同的 Actions（如 Rollover、Shrink、Force Merge、Delete）。

完整示例：李眉的日志 ILM

PUT /_ilm/policy/feixiang_logs_policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": { "max_primary_shard_size": "50gb", "max_age": "1d" },
          "set_priority": { "priority": 100 }
        }
      },
      "warm": {
        "min_age": "3d",
        "actions": {
          "forcemerge": { "max_num_segments": 1 },
          "shrink": { "number_of_shards": 1 },
          "allocate": { "number_of_replicas": 0, "require": { "data": "warm" } }
        }
      },
      "cold": {
        "min_age": "15d",
        "actions": { "allocate": { "number_of_replicas": 0, "require": { "data": "cold" } } }
      },
      "delete": {
        "min_age": "30d",
        "actions": { "delete": {} }
      }
    }
  }
}

关联索引模板

PUT /_index_template/feixiang_logs_template
{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": {
      "index.lifecycle.name": "feixiang_logs_policy",
      "index.lifecycle.rollover_alias": "logs-write"
    }
  }
}

小结

ILM 四阶段：Hot（Rollover）→ Warm（Force Merge + Shrink）→ Cold（Freeze）→ Delete。注意 Rollover 条件是 OR 关系、Shrink 需 Green 状态、min_age 以创建时间计。