Data Life Cycle

The indexes in the open state in Elasticsearch occupy the heap memory to store the inverted indexes. Excessive indexes will cause overhigh memory usage of the cluster or even the memory overflow. Therefore, the life cycle of historical data needs to be managed based on service requirements. For example, data indexes of the last three months can be opened for quick query. Data indexes of the previous three to six months can be closed to release memory. Enable it when necessary. Data indexes of more than six months can be deleted.

You can create an index by time using the index template. For example, you can create an index by day. The index name may be index-yyyy-mm-dd. Different indexes are generated every day. You can close or delete the indexes when clearing historical data.