From 3a4ac4a601b1e6a8918eb00e7dd1046b7098fbe7 Mon Sep 17 00:00:00 2001 From: David Kilfoyle Date: Fri, 15 Aug 2025 15:24:55 -0400 Subject: [PATCH 1/3] Update 'Customize built-in policies' tutorial --- .../tutorial-customize-built-in-policies.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md b/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md index ee5b87350a..fc8d3a16bf 100644 --- a/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md +++ b/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md @@ -9,7 +9,9 @@ products: # Tutorial: Customize built-in policies -{{es}} includes the following built-in {{ilm-init}} policies: +{{es}} includes a set of built-in {{ilm-init}} policies that govern how managed indices transition as they age. This guide demonstrates how you can customize the lifecycle of a managed index, to adjust how the index transitions across [data tiers](/manage-data/lifecycle/data-tiers.md) and what [actions](/manage-data/lifecycle/index-lifecycle-management/index-lifecycle.md#ilm-phase-actions), such as downsampling or shrinking, are performed on the index during each lifecycle phase. + +[{{agent}}](/reference/fleet/index.md) uses the following set of built-in {{ilm-init}} policies to manage backing indices for its data streams: * `logs@lifecycle` * `logs-otel@lifecycle` @@ -19,8 +21,16 @@ products: * `traces@lifecycle` * `traces-otel@lifecycle` -{{agent}} uses these policies to manage backing indices for its data streams. This tutorial shows you how to use {{kib}}’s **Index Lifecycle Policies** to customize these policies based on your application’s performance, resilience, and retention requirements. +This tutorial gives the example of customizing how ingested logging data is managed. Rather than use the default lifecycle settings from the built-in `logs@lifecycle` {{ilm-init}} policy, you can use the **Index Lifecycle Policies** feature in {{kib}} to tailor a new policy based on your application’s specific performance, resilience, and retention requirements. This involves three main steps: + 1. [Create a duplicate of the `logs@lifecycle` policy](#example-using-index-lifecycle-policy-duplicate-ilm-policy). + 2. [Modify the new policy to suit your requirements](#ilm-ex-modify-policy). + 3. [Apply the new policy to your log data using a `logs@custom` component template](#example-using-index-lifecycle-policy-apply-policy). + +:::{tip} +If you're using [Elastic integrations](https://docs.elastic.co/en/integrations) and are not yet familiar with which data streams are associated with them, refer to [Manage the lifecycle policy for integrations data](/manage-data/lifecycle/index-lifecycle-management/manage-lifecycle-integrations-data.md). +If you're looking for a more advanced use case, such as customizing an ILM policy for a selected set of data streams in one or more integrations or namespaces, check the set of tutorials in [Customize data retention policies](/reference/fleet/data-streams-ilm-tutorial.md) in the {{fleet}} and {{agent}} reference documentation. +::: ## Scenario [example-using-index-lifecycle-policy-scenario] From f61209fa93c28dfd77be9b63c463b64a35c4b99b Mon Sep 17 00:00:00 2001 From: David Kilfoyle Date: Tue, 9 Sep 2025 13:11:35 -0400 Subject: [PATCH 2/3] tip for custom new template --- .../tutorial-customize-built-in-policies.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md b/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md index fc8d3a16bf..656b8d6458 100644 --- a/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md +++ b/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md @@ -142,6 +142,10 @@ To apply your new {{ilm-init}} policy to the `logs` index template, create or ed A `*@custom` component template allows you to customize the mappings and settings of managed index templates, without having to override managed index templates or component templates. This type of component template is automatically picked up by the index template. [Learn more](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-component-template). +:::{tip} +If you want your {{ilm-init}} changes to apply only to specific indices, you can create a custom index template directly instead of modifying the custom component template. Use the **Index management** page in {{kib}} or the [index template](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-index-template) API to create a new template. +::: + 1. Click on the **Component Template** tab and click **Create component template**. 2. Under **Logistics**, name the component template `logs@custom`. 3. Under **Index settings**, set the {{ilm-init}} policy name created in the previous step: From 924ba784a78c69e803e733d4ccb6cd3ccbc0b042 Mon Sep 17 00:00:00 2001 From: David Kilfoyle <41695641+kilfoyle@users.noreply.github.com> Date: Wed, 10 Sep 2025 09:36:53 -0400 Subject: [PATCH 3/3] Update manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md Co-authored-by: Vlada Chirmicci --- .../tutorial-customize-built-in-policies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md b/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md index 656b8d6458..15c71750cf 100644 --- a/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md +++ b/manage-data/lifecycle/index-lifecycle-management/tutorial-customize-built-in-policies.md @@ -21,7 +21,7 @@ products: * `traces@lifecycle` * `traces-otel@lifecycle` -This tutorial gives the example of customizing how ingested logging data is managed. Rather than use the default lifecycle settings from the built-in `logs@lifecycle` {{ilm-init}} policy, you can use the **Index Lifecycle Policies** feature in {{kib}} to tailor a new policy based on your application’s specific performance, resilience, and retention requirements. This involves three main steps: +This tutorial covers customizing the way ingested logging data is managed. Rather than use the default lifecycle settings from the built-in `logs@lifecycle` {{ilm-init}} policy, you can use the **Index Lifecycle Policies** feature in {{kib}} to tailor a new policy based on your application’s specific performance, resilience, and retention requirements. This involves three main steps: 1. [Create a duplicate of the `logs@lifecycle` policy](#example-using-index-lifecycle-policy-duplicate-ilm-policy). 2. [Modify the new policy to suit your requirements](#ilm-ex-modify-policy). 3. [Apply the new policy to your log data using a `logs@custom` component template](#example-using-index-lifecycle-policy-apply-policy).