Elasticsearch 索引生命周期管理（ILM、Rollover 与验证）

概述ILM按热/温/冷/删除阶段管理索引生命周期, Rollover在达到大小或年龄阈值时滚动索引。结合Force Merge与Shrink可提升查询效率与降低成本。关键实践与参数Rollover条件: `max_size=50gb` `max_age=7d`Warm阶段: `shrink=1` `forcemerge=1` 并降低副本Cold阶段: 冻结与转低性能存储删除阶段: `delete_after=90d`示例/配置/实现{ "policy": { "phases": { "hot": { "actions": { "rollover": { "max_size": "50gb", "max_age": "7d" } } }, "warm": { "actions": { "shrink": { "number_of_shards": 1 }, "forcemerge": { "max_num_segments": 1 }, "allocate": { "number_of_replicas": 0 } } }, "cold": { "actions": { "freeze": {} } }, "delete": { "min_age": "90d", "actions": { "delete": {} } } } } } { "index_patterns": ["logs-*"], "template": { "settings": { "index.lifecycle.name": "logs-policy", "index.lifecycle.rollover_alias": "logs" } }, "priority": 500 } curl -X POST http://es/_ilm/explain/logs-000001 curl -X POST http://es/logs-000001/_rollover 验证滚动生效: 在达到阈值后生成 `logs-000002`阶段迁移: `_ilm/explain` 显示索引处于预期阶段查询效率: 在Warm阶段强合并后查询耗时下降成本降低: 冷阶段存储费用减少注意事项模板需正确配置别名与策略名称冷阶段可能影响写入, 需只对历史索引应用Force Merge需在低峰期执行持续监控生命周期任务状态