Using ILM with existing indices

While it is recommended to use ILM to manage the index lifecycle from start to finish, it may be useful to use ILM with existing indices, particularly when transitioning from an alternative method of managing the index lifecycle such as Curator, or when migrating from daily indices to rollover-based indices. Such use cases are fully supported, but there are some configuration differences from when ILM can manage the complete index lifecycle.

This section describes strategies to leverage ILM for existing periodic indices when migrating to fully ILM-manged indices, which can be done in a few different ways, each providing different tradeoffs. As an example, we’ll walk through a use case of a very simple logging index with just a field for the log message and a timestamp.

First, we need to create a template for these indices:

PUT _template/mylogs_template
{
  "index_patterns": [
    "mylogs-*"
  ],
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "message": {
        "type": "text"
      },
      "@timestamp": {
        "type": "date"
      }
    }
  }
}

And we’ll ingest a few documents to create a few daily indices:

POST mylogs-pre-ilm-2019.06.24/_doc
{
  "@timestamp": "2019-06-24T10:34:00",
  "message": "this is one log message"
}

POST mylogs-pre-ilm-2019.06.25/_doc
{
  "@timestamp": "2019-06-25T17:42:00",
  "message": "this is another log message"
}

Now that we have these indices, we’ll look at a few different ways of migrating these indices to ILM.