EElasticsearch Handbook

ORTA

Index Lifecycle Management (ILM)

ILM, index'lerin yaşam döngüsünü otomatik yönetir: Hot → Warm → Cold → Frozen → Delete. Özellikle log ve time-series verileri için kritiktir.

Kod örneği tercihiBu sayfadaki istemci örneklerini birlikte değiştirir.
HOT SSD, aktif yazma 0-7 gün Rollover: 50GB/7d WARM HDD, read-only 7-30 gün Force merge, shrink COLD Searchable snapshot 30-90 gün Replica = 0 FROZEN Shared cache 90-365 gün Minimum resource DELETE Otomatik silme >365 gün

ILM Policy Tanımlama

# ILM policy oluşturma
curl -X PUT "http://localhost:9200/_ilm/policy/logs-policy" -H "Content-Type: application/json" -d'
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_primary_shard_size": "50gb",
            "max_age": "7d"
          },
          "set_priority": { "priority": 100 }
        }
      },
      "warm": {
        "min_age": "7d",
        "actions": {
          "shrink": { "number_of_shards": 1 },
          "forcemerge": { "max_num_segments": 1 },
          "set_priority": { "priority": 50 },
          "allocate": { "require": { "data": "warm" } }
        }
      },
      "cold": {
        "min_age": "30d",
        "actions": {
          "allocate": { "number_of_replicas": 0 },
          "set_priority": { "priority": 0 }
        }
      },
      "delete": {
        "min_age": "365d",
        "actions": { "delete": {} }
      }
    }
  }
}'

# Index template with ILM
curl -X PUT "http://localhost:9200/_index_template/logs-template" -H "Content-Type: application/json" -d'
{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": {
      "number_of_shards": 2,
      "number_of_replicas": 1,
      "index.lifecycle.name": "logs-policy",
      "index.lifecycle.rollover_alias": "logs-write"
    }
  }
}'
public async Task SetupIlmAsync()
{
    // Create ILM policy
    await _client.IndexLifecycleManagement.PutLifecycleAsync("logs-policy", p => p
        .Policy(pol => pol
            .Phases(ph => ph
                .Hot(h => h
                    .MinAge("0ms")
                    .Actions(a => a
                        .Rollover(r => r.MaxPrimaryShardSize("50gb").MaxAge("7d"))
                        .SetPriority(sp => sp.Priority(100))))
                .Warm(w => w
                    .MinAge("7d")
                    .Actions(a => a
                        .Shrink(sh => sh.NumberOfShards(1))
                        .ForceMerge(fm => fm.MaxNumSegments(1))
                        .SetPriority(sp => sp.Priority(50))))
                .Cold(c => c
                    .MinAge("30d")
                    .Actions(a => a
                        .SetPriority(sp => sp.Priority(0))))
                .Delete(d => d
                    .MinAge("365d")
                    .Actions(a => a.Delete(del => del))))));
}

Örnek: SaaS platformunda günlük 100GB log üretilir. ILM ile: 7 gün SSD'de (hızlı arama), 30 gün HDD'de (yavaş ama erişilebilir), 90 gün frozen (snapshot-based), 1 yıl sonra silme. Depolama maliyeti %70 düşer.