Time series data increase over time. You can use the index lifecycle management (ILM) feature to periodically roll over the data to new indexes. This ensures high query efficiency and reduces query costs. As indexes age and fewer queries are required, you can migrate the indexes to a less expensive disk and reduce the numbers of primary and replica shards. This topic describes how to use ILM to manage Heartbeat indexes.
Background information
A large number of time series indexes whose names start with heartbeat- exist in your Elasticsearch cluster, and the size of a single index is about 4 MB each day. The number of shards increases with the data volume. This may cause cluster overload. In this case, you must configure different rollover policies for indexes in the following four phases: hot, warm, cold, and delete. In the hot phase, data in historical monitoring indexes whose names start with heartbeat- is rolled over to new indexes. In the warm phase, indexes are shrunk, and segments in each index are merged. In the cold phase, data is migrated from hot nodes to warm nodes. In the delete phase, data is deleted on a regular basis.
Precautions
- An ILM policy can be attached to an index only after an index template and an alias are configured for the index.
- If you modify an ILM policy during a rollover, the new policy takes effect from the next rollover.
Procedure
Step 1: Create an Elasticsearch cluster that uses the hot-warm architecture
- Create an Elasticsearch cluster that uses the hot-warm architecture and view the hot
or warm attribute of nodes in the cluster. The cluster that uses the hot-warm architecture contains hot nodes and warm nodes. This architecture improves the performance and stability of your Elasticsearch cluster. The following table lists the differences between hot nodes and warm nodes.
Node type Type of data stored Read and write performance Specifications Disk Hot node Recent data, such as log data over the last two days. High High, such as 32 vCPUs and 64 GiB of memory We recommend that you use a standard SSD. You can specify the storage space based on the volume of data. Warm node Historical data, such as log data before the last two days. Low Low, such as 8 vCPUs and 32 GiB of memory We recommend that you use an ultra disk. You can specify the storage space based on the volume of data.
- On the Console tab of the page that appears, run the following command to view the attributes of
nodes:
GET _cat/nodeattrs?v&h=host,attr,valueIf the command is successfully run, the result shown in the following figure is returned. This figure shows that the Elasticsearch cluster contains three hot nodes and two warm nodes to support the hot-warm architecture.
- On the Console tab of the page that appears, run the following command to view the attributes of
nodes:
Step 2: Enable and configure the ILM feature in the heartbeat.yml file
To manage Heartbeat indexes by using the ILM feature of Elasticsearch, you can configure the feature in the heartbeat.yml file. For more information, see Set up index lifecycle management.
Step 3: Create an ILM policy
./heartbeat setup --ilm-policy command to load the default policy and write it to Elasticsearch. You can run the
./heartbeat export ilm-policy command to export the default policy to stdout. Then, you can modify the default
policy to manually create an ILM policy.
Run the following command in the Kibana console of the Elasticsearch cluster to create an ILM policy:
PUT /_ilm/policy/hearbeat-policy
{
"policy": {
"phases": {
"hot": {
"actions": {
"rollover": {
"max_size": "5mb",
"max_age": "1d",
"max_docs": 100
}
}
},
"warm": {
"min_age": "60s",
"actions": {
"forcemerge": {
"max_num_segments":1
},
"shrink": {
"number_of_shards":1
}
}
},
"cold": {
"min_age": "3m",
"actions": {
"allocate": {
"require": {
"box_type": "warm"
}
}
}
},
"delete": {
"min_age": "1h",
"actions": {
"delete": {}
}
}
}
}
}| Parameter | Description |
|---|---|
| hot | A rollover is triggered if an index to which the ILM policy is attached meets one
of the following conditions: The volume of data in the index reaches 5 MB, the index
has been used for more than one day, and the number of documents in the index exceeds
100. During the rollover, the system creates an index and enables the ILM policy for
the new index. The original index enters the warm phase 60 seconds after the rollover.
Notice If the value of max_docs, max_size, or max_age is reached during a rollover, Elasticsearch archives the index.
|
| warm | After the index enters the warm phase, the system shrinks it down to a new index that has only one primary shard and merges segments in the index into one segment. The index enters the cold phase 3 minutes after the rollover starts. |
| cold | After the index enters the cold phase, the system migrates the index from hot nodes to warm nodes. The index enters the delete phase 1 hour later after the rollover starts. |
| delete | After the index enters the delete phase, it is deleted. |
- After an ILM policy is created, you cannot change the policy name.
- In this step, you can specify the max_age parameter in the minimum unit of seconds. If you use the Kibana console to create an ILM policy, you can specify this parameter only in the minimum unit of hours.
Step 4: Attach the ILM policy to an index template
After you start Heartbeat, the system creates a Heartbeat index template in your Elasticsearch cluster. You must attach the ILM policy created in Step 3: Create an ILM policy to this index template.
- In the Index lifecycle policies section, find the ILM policy you created, and choose .
- In the dialog box that appears, select an index template from the Index template drop-down list and enter an alias for indexes in the Alias for rollover index field.
Step 5: Attach the ILM policy to an index
After you start Heartbeat, the system creates Heartbeat indexes in your Elasticsearch cluster. You must attach the ILM policy that is attached to the index template you created to the first index created by using the template. For more information, see Step 4: Attach the ILM policy to an index template.
- On the Summary tab of the pane that appears, choose to remove the default policy of Heartbeat.
- In the dialog box that appears, select the ILM policy you created in Step 3: Create an ILM policy from the Lifecycle policy drop-down list and set Index rollover alias to the alias that you specify in Step 4: Attach the ILM policy to an index template. Then, click Add policy.
If the ILM policy is attached to the index, the information shown in the following figure appears.
Step 6: View indexes in different phases
You can use this method to view indexes in other phases.
FAQ
Q: How do I configure a check interval for an ILM policy?
PUT _cluster/settings
{
"transient": {
"indices.lifecycle.poll_interval":"1m"
}
}