日志保留与冷热分离

日志越久查询越少，把全量数据放 SSD 很浪费。ILM（Index Lifecycle Management）让索引按年龄在热/温/冷节点间迁移并最终删除。本文配一条 30 天滚动、90 天删除的策略。

适用环境

# 确认 ES 集群节点角色
curl -s http://localhost:9200/_cat/nodes?v&h=name,node.role
# 确认 ILM 可用（7.x+）
curl -s http://localhost:9200/_ilm/status

操作步骤

1. 创建 ILM 策略

curl -X PUT "http://localhost:9200/_ilm/policy/logs-lifecycle" -H 'Content-Type: application/json' -d '{
  "policy": {
    "phases": {
      "hot":    { "min_age":"0ms", "actions": { "rollover": { "max_age":"30d", "max_size":"50gb" } } },
      "warm":   { "min_age":"30d", "actions": { "migrate": {"data_tier":"warm"} } },
      "delete": { "min_age":"90d", "actions": { "delete": {} } }
    }
  }
}'

2. 创建索引模板绑定策略

curl -X PUT "http://localhost:9200/_index_template/logs-template" -H 'Content-Type: application/json' -d '{
  "index_patterns":["logs-app-*"],
  "template": { "settings": { "index.lifecycle.name":"logs-lifecycle", "index.lifecycle.rollover_alias":"logs-app" } }
}'

3. 创建初始别名索引

curl -X PUT "http://localhost:9200/logs-app-000001" -H 'Content-Type: application/json' -d '{
  "aliases": { "logs-app": { "is_write_index": true } }
}'

验证

curl -s http://localhost:9200/_ilm/policy/logs-lifecycle?pretty | head -n 5
curl -s 'http://localhost:9200/_cat/indices/logs-app-*?v'

常见坑

WARNING

ILM 依赖 rollover_alias，写入必须用别名而非具体索引名；直接用 logs-app-000001 写会导致永不 rollover。

DANGER

delete 阶段会真正删除数据。先设较长 min_age 并在测试索引验证，避免误删生产日志。

参考资料

• ILM 官方文档
• Rollover 说明
• Data Tiers 冷热分层