Define an ILM policy, attach it via a template and bootstrap the rollover chain

Command

PUT _ilm/policy/log-policy
{
  "policy": {
    "phases": {
      "hot": { "actions": { "rollover": { "max_primary_shard_size": "50gb", "max_age": "1d" }, "set_priority": { "priority": 100 } } },
      "warm": { "min_age": "7d", "actions": { "shrink": { "number_of_shards": 1 }, "forcemerge": { "max_num_segments": 1 }, "set_priority": { "priority": 50 } } },
      "delete": { "min_age": "30d", "actions": { "delete": {} } }
    }
  }
}
PUT _index_template/log
{
  "index_patterns": ["log-*"],
  "priority": 500,
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1,
      "index.lifecycle.name": "log-policy",
      "index.lifecycle.rollover_alias": "log"
    }
  }
}
# Create the first index with the write alias (its name must end with a number such as -000001):
PUT log-000001
{
  "aliases": { "log": { "is_write_index": true } }
}

What it does

Creates an ILM policy with hot (rollover), warm (shrink + force merge) and delete phases, applies the policy and rollover alias to new indices through a template, and creates the first index of the chain with the write alias.

When to use it

When automating index size, retention and deletion for time series data such as logs or metrics.

Caution

min_age in the warm and delete phases is counted from the rollover time, not from index creation. Policy changes apply to existing indices only after their current phase completes. Shrink and forcemerge in the warm phase generate heavy IO; the index must not be written to until the force merge finishes. ILM runs every 10 minutes by default, so conditions are not evaluated instantly.