Elasticsearch ILM滚动索引与冷热分层实践

概述目标：通过索引生命周期管理（ILM）实现按大小/文档数自动滚动与冷热数据分层，控制成本与性能。适用：日志/事件大规模写入与查询场景。核心与实战创建ILM策略：PUT _ilm/policy/logs_policy { "policy": { "phases": { "hot": { "actions": { "rollover": {"max_size": "50gb", "max_docs": 50_000_000}, "set_priority": {"priority": 100} } }, "warm": { "min_age": "7d", "actions": { "allocate": {"include": {"box_type": "warm"}}, "forcemerge": {"max_num_segments": 1}, "set_priority": {"priority": 50} } }, "cold": { "min_age": "30d", "actions": { "allocate": {"include": {"box_type": "cold"}}, "set_priority": {"priority": 0} } }, "delete": { "min_age": "90d", "actions": {"delete": {}} } } } } 索引模板与别名（写别名）：PUT _index_template/logs_template { "index_patterns": ["logs-*"], "template": { "settings": { "index.lifecycle.name": "logs_policy", "index.lifecycle.rollover_alias": "logs-write" }, "mappings": {"properties": {"@timestamp": {"type": "date"}}} } } PUT logs-000001 { "aliases": {"logs-write": {"is_write_index": true}} } 触发滚动：POST /logs-write/_rollover 示例查看ILM状态：GET logs-000001/_ilm/explain 节点属性：PUT _cluster/settings { "persistent": { "cluster.routing.allocation.awareness.attributes": "box_type" } } 验证与监控索引与别名：GET /_cat/indices?v GET /_cat/aliases?v ILM执行：GET _ilm/status GET logs-000002/_ilm/explain 成本与性能：观察热/warm/cold节点资源使用与查询延迟；确定保留与合并策略合理。常见误区未使用写别名导致滚动后写入失败；必须使用`rollover_alias`。`allocate`条件与节点属性不匹配导致分配失败；需设置节点`box_type`标签。保留过长导致存储膨胀；需根据业务设定删除阶段。结语ILM滚动与冷热分层可显著降低ES成本并保持写入与查询稳定，通过别名与节点分配实现平滑演进。