ILM – automating rollover
ILM is often used in conjunction with rolling-over indices. These indices usually contain append-only data such as logs.
The standard management of the rollover indices is as follows:
- Creation of the index, generally managed by an index template.
- Rolling over the index when it reaches a particular size (the default is 50 GB) or a predefined number of documents.
- If required, move the indices to different tiers.
- Delete the index to be aligned with retention policies.
The rollover functionality is generally used with managed indices called data streams. They are append-only data indices that automatically roll over a new index when it meets some criteria of size and number of documents.
These indices are used mainly for the following:
- Logs
- Events
- Metrics
- Continuously generated data
Getting ready
You need an up-and-running Elasticsearch installation, as we described in the Downloading and installing...
