Elasticsearch ILM滚动索引与冷热分层实践

概述 - 目标：通过索引生命周期管理（ILM）实现按大小/文档数自动滚动与冷热数据分层，控制成本与性能。 - 适用：日志/事件大规模写入与查询场景。 核心与实战 - 创建ILM策略： ``` PUT _ilm/policy/logs_policy { "policy": { "phases": { "hot": { "actions": { "rollover": {"max_size": "50gb", "max_docs": 50_000_000}, "set_priority": {"priority": 100} } }, "warm": { "min_age": "7d", "actions": { "allocate": {"include": {"box_type": "warm"}}, "forcemerge": {"max_num_segments": 1}, "set_priority": {"priority": 50} } }, "cold": { "min_age": "30d", "actions": { "allocate": {"include": {"box_type": "cold"}}, "set_priority": {"priority": 0} } }, "delete": { "min_age": "90d", "actions": {"delete": {}} } } } } ``` - 索引模板与别名（写别名）： ``` PUT _index_template/logs_template { "index_patterns": ["logs-*"], "template": { "settings": { "index.lifecycle.name": "logs_policy", "index.lifecycle.rollover_alias": "logs-write" }, "mappings": {"properties": {"@timestamp": {"type": "date"}}} } } PUT logs-000001 { "aliases": {"logs-write": {"is_write_index": true}} } ``` - 触发滚动： ``` POST /logs-write/_rollover ``` 示例 - 查看ILM状态： ``` GET logs-000001/_ilm/explain ``` - 节点属性： ``` PUT _cluster/settings { "persistent": { "cluster.routing.allocation.awareness.attributes": "box_type" } } ``` 验证与监控 - 索引与别名： ``` GET /_cat/indices?v GET /_cat/aliases?v ``` - ILM执行： ``` GET _ilm/status GET logs-000002/_ilm/explain ``` - 成本与性能： - 观察热/warm/cold节点资源使用与查询延迟；确定保留与合并策略合理。 常见误区 - 未使用写别名导致滚动后写入失败；必须使用`rollover_alias`。 - `allocate`条件与节点属性不匹配导致分配失败；需设置节点`box_type`标签。 - 保留过长导致存储膨胀；需根据业务设定删除阶段。 结语 - ILM滚动与冷热分层可显著降低ES成本并保持写入与查询稳定，通过别名与节点分配实现平滑演进。