Elasticsearch 索引生命周期管理（ILM、Rollover 与验证）

## 概述 ILM按热/温/冷/删除阶段管理索引生命周期, Rollover在达到大小或年龄阈值时滚动索引。结合Force Merge与Shrink可提升查询效率与降低成本。 ## 关键实践与参数 - Rollover条件: `max_size=50gb` `max_age=7d` - Warm阶段: `shrink=1` `forcemerge=1` 并降低副本 - Cold阶段: 冻结与转低性能存储 - 删除阶段: `delete_after=90d` ## 示例/配置/实现 ```json { "policy": { "phases": { "hot": { "actions": { "rollover": { "max_size": "50gb", "max_age": "7d" } } }, "warm": { "actions": { "shrink": { "number_of_shards": 1 }, "forcemerge": { "max_num_segments": 1 }, "allocate": { "number_of_replicas": 0 } } }, "cold": { "actions": { "freeze": {} } }, "delete": { "min_age": "90d", "actions": { "delete": {} } } } } } ``` ```json { "index_patterns": ["logs-*"], "template": { "settings": { "index.lifecycle.name": "logs-policy", "index.lifecycle.rollover_alias": "logs" } }, "priority": 500 } ``` ```bash curl -X POST http://es/_ilm/explain/logs-000001 curl -X POST http://es/logs-000001/_rollover ``` ## 验证 - 滚动生效: 在达到阈值后生成 `logs-000002` - 阶段迁移: `_ilm/explain` 显示索引处于预期阶段 - 查询效率: 在Warm阶段强合并后查询耗时下降 - 成本降低: 冷阶段存储费用减少 ## 注意事项 - 模板需正确配置别名与策略名称 - 冷阶段可能影响写入, 需只对历史索引应用 - Force Merge需在低峰期执行 - 持续监控生命周期任务状态