1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
[[ilm]]
= Curator and Index Lifecycle Management
[partintro]
--
Beginning with Elasticsearch version 6.6, Elasticsearch has provided
{ref}/index-lifecycle-management.html[Index Lifecycle Management] (or, ILM) to
users with at least a Basic license. ILM provides users with many of the most
common index management features as a matter of policy, rather than execution
time analysis (which is how Curator works).
--
[[ilm-actions]]
== ILM Actions
ILM applies policy actions as indices enter time-oriented phases:
* Hot
* Warm
* Cold
* Delete
The policy actions include:
* {ref}/ilm-set-priority.html[Set Priority]
* {ref}/ilm-rollover.html[Rollover]
* {ref}/ilm-unfollow.html[Unfollow]
* {ref}/ilm-allocate.html[Allocate]
* {ref}/ilm-readonly.html[Read-Only]
* {ref}/ilm-forcemerge.html[Force Merge]
* {ref}/ilm-shrink.html[Shrink]
* {ref}/ilm-delete.html[Delete]
[[ilm-or-curator]]
== ILM or Curator?
If ILM provides the functionality to manage your index lifecycle, and you have
at least a Basic license, consider using ILM in place of Curator. Many of the
Stack components make use of ILM by default.
[[ilm-beats]]
=== Beats
NOTE: All Beats share a similar ILM configuration. Filebeats is used as a
reference here.
Starting with version 7.0, Filebeat uses index lifecycle management by default when it connects to a cluster that supports lifecycle management. Filebeat loads the default policy automatically and applies it to any indices created by Filebeat.
You can view and edit the policy in the Index lifecycle policies UI in Kibana. For more information about working with the UI, see
{esref}/index-lifecycle-management.html[Index lifecyle policies].
Read more about Filebeat and ILM {fbref}/ilm.html[here].
[[ilm-logstash]]
=== Logstash
NOTE: The Index Lifecycle Management feature requires version 9.3.1 or higher of the
`logstash-output-elasticsearch` plugin.
Logstash can use [Index Lifecycle Management](docs-content://manage-data/lifecycle/index-lifecycle-management/index-lifecycle.md)
to automate the management of indices over time.
The use of Index Lifecycle Management is controlled by the `ilm_enabled` setting. By
default, this will automatically detect whether the Elasticsearch instance
supports ILM, and will use it if it is available. `ilm_enabled` can also be set to
`true` or `false` to override the automatic detection, or disable ILM.
Read more about [Logstash and ILM](logstash-docs-md://lsr/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm).
[[ilm-and-curator]]
== ILM and Curator!
WARNING: Curator will not act on any index associated with an ILM policy without
setting `allow_ilm_indices` to `true`.
Curator and ILM _can_ coexist. However, to prevent Curator from accidentally
interfering, or colliding with ILM policies, any index associated with an ILM
policy name is excluded by default. This is true whether you have a Basic
license or not, or whether the ILM policy is enabled or not.
Curator can be configured to work with ILM-enabled indices by setting the
<<option_allow_ilm,`allow_ilm_indices`>> option to `true` for any action.
Learn more about Index Lifecycle Management
{ref}/index-lifecycle-management.html[here].
|
