Elasticsearch ILM滚动索引与冷热分层实践

概述目标：通过索引生命周期管理（ILM）实现按大小/文档数自动滚动与冷热数据分层，控制成本与性能。适用：日志/事件大规模写入与查询场景。核心与实战创建ILM策略：PUT _ilm/policy/logs_policy

{

"policy": {

"phases": {

"hot": {

"actions": {

"rollover": {"max_size": "50gb", "max_docs": 50_000_000},

"set_priority": {"priority": 100}

}

},

"warm": {

"min_age": "7d",

"actions": {

"allocate": {"include": {"box_type": "warm"}},

"forcemerge": {"max_num_segments": 1},

"set_priority": {"priority": 50}

}

},

"cold": {

"min_age": "30d",

"actions": {

"allocate": {"include": {"box_type": "cold"}},

"set_priority": {"priority": 0}

}

},

"delete": {

"min_age": "90d",

"actions": {"delete": {}}

}

}

}

}

索引模板与别名（写别名）：PUT _index_template/logs_template

{

"index_patterns": ["logs-*"],

"template": {

"settings": {

"index.lifecycle.name": "logs_policy",

"index.lifecycle.rollover_alias": "logs-write"

},

"mappings": {"properties": {"@timestamp": {"type": "date"}}}

}

}

PUT logs-000001

{

"aliases": {"logs-write": {"is_write_index": true}}

}

触发滚动：POST /logs-write/_rollover

示例查看ILM状态：GET logs-000001/_ilm/explain

节点属性：PUT _cluster/settings

{

"persistent": {

"cluster.routing.allocation.awareness.attributes": "box_type"

}

}

验证与监控索引与别名：GET /_cat/indices?v

GET /_cat/aliases?v

ILM执行：GET _ilm/status

GET logs-000002/_ilm/explain

成本与性能：观察热/warm/cold节点资源使用与查询延迟；确定保留与合并策略合理。常见误区未使用写别名导致滚动后写入失败；必须使用`rollover_alias`。`allocate`条件与节点属性不匹配导致分配失败；需设置节点`box_type`标签。保留过长导致存储膨胀；需根据业务设定删除阶段。结语ILM滚动与冷热分层可显著降低ES成本并保持写入与查询稳定，通过别名与节点分配实现平滑演进。