Index Templates and Index Lifecycle Management (ILM)

Build the mental model

Applications often create new indices repeatedly (say, a new daily log index — `logs-2026-08-29`) — manually writing the mapping for every new index invites typos and inconsistency. An index template automatically applies a mapping and settings to any new index whose name matches a pattern (like `logs-*`) — once a template is defined, creating a new index no longer needs the mapping specified again. ILM (Index Lifecycle Management) can automatically transition time-series-like data indices (logs, metrics, event streams) through phases: "hot" (active writes, fast storage) → "warm" (read-only, less frequent access) → "cold" (archival, cheap storage) → "delete" (retention period expired) — instead of letting a single index grow infinitely, an ILM policy coordinates index rollover, auto-creating a new index once a size or age threshold is crossed. Think of it like setting an automatic archive-and-cleanup schedule for old files instead of letting a hard drive fill up completely — an oversized single index degrades query performance and complicates cluster management, and ILM automates that problem away.

Connect it to a real scenario

Say the Tutorial Platform team stores user search-query analytics events ("user X searched for 'redis'") in a daily index (`search-logs-2026-08-29`) — define an index template so any new index matching the `search-logs-*` pattern automatically gets the mapping (`query`, `userId`, `timestamp` fields). Set the ILM policy to "7 days hot, 30 days warm, delete after 90 days" — retention is enforced automatically without a manual cleanup script deleting old event logs. The Tutorial Platform's `tutorials` index (small data volume, not time-series) doesn't need ILM — reserve ILM for time-series-like data.

Index templates auto-apply mapping and settings to name-pattern matches
ILM automates index lifecycle through hot/warm/cold/delete phases
ILM is suited to time-series-like data specifically

Try the working example

json

PUT /_index_template/search-logs-template
{
  "index_patterns": ["search-logs-*"],
  "template": {
    "mappings": {
      "properties": {
        "query":     { "type": "text" },
        "userId":    { "type": "keyword" },
        "timestamp": { "type": "date" }
      }
    },
    "settings": {
      "index.lifecycle.name": "search-logs-ilm-policy"
    }
  }
}

You should see

You get an index template that automatically applies the mapping to every new index matching the `search-logs-*` pattern.

5-minute try-it

Design an index template for indices matching `user-activity-*` with `eventType` (keyword), `userId` (keyword), and `occurredAt` (date) fields — include an ILM policy name in the settings too.

One important caution

Attaching an ILM policy to a small, non-time-series index (like the `tutorials` catalog data), adding unnecessary rollover and phase-transition complexity — ILM is meant for data with time-series-like growth patterns.

Writing an index name pattern that doesn't precisely match (a typo, a wrong wildcard) after defining an index template — the template silently fails to apply, and indexing falls back to dynamic mapping.

Elasticsearch Guide — Index Lifecycle Management — Elastic