Elasticsearch ILM 滚动与生命周期策略实战

创建 ILM 策略：PUT _ilm/policy/logs_policy { "policy": { "phases": { "hot": { "actions": { "rollover": { "max_size": "50gb", "max_age": "7d" } } }, "warm": { "actions": { "shrink": { "number_of_shards": 1 }, "forcemerge": { "max_num_segments": 1 } } }, "delete": { "min_age": "30d", "actions": { "delete": {} } } } } } 创建索引模板与别名：PUT _index_template/logs_template { "index_patterns": ["logs-*"] , "template": { "settings": { "index.lifecycle.name": "logs_policy", "index.lifecycle.rollover_alias": "logs" } }, "priority": 500 } PUT logs-000001 { "aliases": { "logs": { "is_write_index": true } } } 触发滚动：POST logs/_rollover