Example: Full ILM Policy

Here’s a complete ILM policy for logs:

PUT _ilm/policy/logs_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": { "max_size": "30gb", "max_age": "7d" }
        }
      },
      "warm": {
        "min_age": "30d",
        "actions": {
          "allocate": { "include": { "box_type": "warm" } },
          "forcemerge": { "max_num_segments": 1 }
        }
      },
      "cold": {
        "min_age": "90d",
        "actions": {
          "allocate": { "include": { "box_type": "cold" } },
          "freeze": {}
        }
      },
      "frozen": {
        "min_age": "180d",
        "actions": {
          "searchable_snapshot": {
            "snapshot_repository": "s3_repository"
          }
        }
      },
      "delete": {
        "min_age": "365d",
        "actions": { "delete": {} }
      }
    }
  }
}

Applying the ILM Policy

Attach it to an index template:

PUT _index_template/logs_template
{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": {
      "number_of_shards": 3,
      "index.lifecycle.name": "logs_policy",
      "index.lifecycle.rollover_alias": "logs"
    }
  }
}

Create the first index:

PUT logs-000001
{
  "aliases": {
    "logs": { "is_write_index": true }
  }
}

Elasticsearch will automatically create logs-000002 when the rollover condition is reached.

Checking ILM Status

To see the current ILM phase of an index:

GET logs-000001/_ilm/explain

Example result:

"phase": "cold",
"action": "allocate",
"step": "completed"

List all ILM policies:

GET _ilm/policy

Hot–Warm–Cold–Frozen Architecture

ILM works best when you organize your cluster into node tiers:

Tier	Role	Hardware	Data Age	License
Hot	Active data	SSD, fast CPU	0–30 days	Basic
Warm	Old but used data	HDD	30–90 days	Basic
Cold	Archived, rarely used	Slow storage	90–180 days	Basic
Frozen	Snapshot-based, S3	Cloud object storage	180+ days	Platinum / Enterprise

You can label nodes like this:

node.attr.box_type: hot

and ILM will move indices automatically between tiers.

Best Practices

• Use rollover to keep index size balanced (30–50 GB).
• Always use aliases for write operations.
• Configure node tiers before applying ILM.
• Snapshot before delete phase.
• Monitor with:

GET _cat/indices?v
GET _cluster/health

• If using frozen, set up an S3 repository and test searchable snapshot first.

Common Problems

Issue	Cause	Solution
ILM stuck in hot phase	Alias missing	Add rollover alias
Index not moved	Node attribute not found	Define box_type on nodes
Storage full	No delete phase	Add delete policy
Frozen not working	No Platinum license	Use cold phase or snapshots manually

ILM vs. Curator

Feature	ILM	Curator
Automatic Phases	yes	no
Rollover Support	yes	no
Hot–Warm–Cold	yes	yes (manual)
Frozen / S3 Search	yes (Platinum+)	no
Built-in to Elasticsearch	yes	no (external tool)

ILM is the modern replacement for Curator, smarter, simpler, and integrated.

Conclusion

ILM is your auto-pilot for Elasticsearch data.
It helps you keep your cluster clean, efficient, and affordable, automatically managing indices from hot to frozen.
Even your oldest data can stay searchable from S3, if you have the right license.

“Hot data lives in memory, cold data sleeps on disk, and frozen data dreams in the cloud.”

With ILM, your data never overwhelms you again, it simply flows through its natural lifecycle.