Configure Elasticsearch Index Lifecycle Management (ILM) for automated data retention

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Default values
ELASTICSEARCH_HOST="${1:-localhost}"
ELASTICSEARCH_PORT="${2:-9200}"
RETENTION_DAYS="${3:-30}"
HOT_SIZE="${4:-5GB}"
HOT_AGE="${5:-1d}"

usage() {
    echo "Usage: $0 [elasticsearch_host] [elasticsearch_port] [retention_days] [hot_size] [hot_age]"
    echo "Example: $0 localhost 9200 30 5GB 1d"
    echo "Defaults: localhost 9200 30 5GB 1d"
    exit 1
}

cleanup() {
    echo -e "${RED}[ERROR] Script failed. Check Elasticsearch logs for details.${NC}"
}

trap cleanup ERR

print_step() {
    echo -e "${BLUE}[$1] $2${NC}"
}

print_success() {
    echo -e "${GREEN}[SUCCESS] $1${NC}"
}

print_warning() {
    echo -e "${YELLOW}[WARNING] $1${NC}"
}

print_error() {
    echo -e "${RED}[ERROR] $1${NC}"
}

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update"
            ES_CONFIG_DIR="/etc/elasticsearch"
            ES_SERVICE="elasticsearch"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            ES_CONFIG_DIR="/etc/elasticsearch"
            ES_SERVICE="elasticsearch"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            ES_CONFIG_DIR="/etc/elasticsearch"
            ES_SERVICE="elasticsearch"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            ES_CONFIG_DIR="/etc/elasticsearch"
            ES_SERVICE="elasticsearch"
            ;;
        *)
            print_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    print_error "Cannot detect distribution. /etc/os-release not found."
    exit 1
fi

# Check if running as root or with sudo
if [[ $EUID -ne 0 ]]; then
    print_error "This script must be run as root or with sudo"
    exit 1
fi

print_step "1/10" "Installing prerequisites..."
$PKG_UPDATE
$PKG_INSTALL curl jq

print_step "2/10" "Checking Elasticsearch connectivity..."
if ! curl -s "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_cluster/health" > /dev/null; then
    print_error "Cannot connect to Elasticsearch at ${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"
    print_warning "Please ensure Elasticsearch is running and accessible"
    exit 1
fi

print_success "Connected to Elasticsearch"

print_step "3/10" "Checking cluster health..."
CLUSTER_STATUS=$(curl -s "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_cluster/health" | jq -r '.status')
echo "Cluster status: $CLUSTER_STATUS"

if [ "$CLUSTER_STATUS" = "red" ]; then
    print_warning "Cluster status is RED. Consider fixing cluster issues before proceeding."
fi

print_step "4/10" "Reviewing existing indices..."
curl -s "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_cat/indices?v&s=store.size:desc" | head -10

print_step "5/10" "Creating basic logs ILM policy..."
curl -X PUT "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_ilm/policy/logs-policy" \
  -H 'Content-Type: application/json' -d"{
  \"policy\": {
    \"phases\": {
      \"hot\": {
        \"min_age\": \"0ms\",
        \"actions\": {
          \"rollover\": {
            \"max_size\": \"${HOT_SIZE}\",
            \"max_age\": \"${HOT_AGE}\",
            \"max_docs\": 10000000
          },
          \"set_priority\": {
            \"priority\": 100
          }
        }
      },
      \"warm\": {
        \"min_age\": \"${HOT_AGE}\",
        \"actions\": {
          \"set_priority\": {
            \"priority\": 50
          },
          \"allocate\": {
            \"number_of_replicas\": 1
          },
          \"forcemerge\": {
            \"max_num_segments\": 1
          }
        }
      },
      \"delete\": {
        \"min_age\": \"${RETENTION_DAYS}d\",
        \"actions\": {
          \"delete\": {}
        }
      }
    }
  }
}"

print_success "Basic logs policy created"

print_step "6/10" "Creating advanced application logs ILM policy..."
curl -X PUT "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_ilm/policy/application-logs-policy" \
  -H 'Content-Type: application/json' -d"{
  \"policy\": {
    \"phases\": {
      \"hot\": {
        \"min_age\": \"0ms\",
        \"actions\": {
          \"rollover\": {
            \"max_size\": \"10GB\",
            \"max_age\": \"7d\",
            \"max_docs\": 50000000
          },
          \"set_priority\": {
            \"priority\": 100
          }
        }
      },
      \"warm\": {
        \"min_age\": \"7d\",
        \"actions\": {
          \"set_priority\": {
            \"priority\": 50
          },
          \"allocate\": {
            \"number_of_replicas\": 1
          },
          \"forcemerge\": {
            \"max_num_segments\": 1
          }
        }
      },
      \"cold\": {
        \"min_age\": \"30d\",
        \"actions\": {
          \"set_priority\": {
            \"priority\": 0
          },
          \"allocate\": {
            \"number_of_replicas\": 0
          }
        }
      },
      \"delete\": {
        \"min_age\": \"90d\",
        \"actions\": {
          \"delete\": {}
        }
      }
    }
  }
}"

print_success "Advanced application logs policy created"

print_step "7/10" "Creating metrics ILM policy..."
curl -X PUT "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_ilm/policy/metrics-policy" \
  -H 'Content-Type: application/json' -d'{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_size": "2GB",
            "max_age": "1d",
            "max_docs": 5000000
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "warm": {
        "min_age": "3d",
        "actions": {
          "set_priority": {
            "priority": 50
          },
          "forcemerge": {
            "max_num_segments": 1
          }
        }
      },
      "delete": {
        "min_age": "14d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}'

print_success "Metrics policy created"

print_step "8/10" "Creating index templates with ILM policies..."
curl -X PUT "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_index_template/logs-template" \
  -H 'Content-Type: application/json' -d'{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": {
      "index.lifecycle.name": "logs-policy",
      "index.lifecycle.rollover_alias": "logs",
      "number_of_shards": 1,
      "number_of_replicas": 1
    }
  }
}'

curl -X PUT "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_index_template/metrics-template" \
  -H 'Content-Type: application/json' -d'{
  "index_patterns": ["metrics-*"],
  "template": {
    "settings": {
      "index.lifecycle.name": "metrics-policy",
      "index.lifecycle.rollover_alias": "metrics",
      "number_of_shards": 1,
      "number_of_replicas": 1
    }
  }
}'

print_success "Index templates created"

print_step "9/10" "Verifying ILM policies..."
echo "Created ILM policies:"
curl -s "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_ilm/policy" | jq -r 'keys[]' | grep -E "(logs-policy|application-logs-policy|metrics-policy)"

print_step "10/10" "Final verification and status..."
echo "ILM Status:"
curl -s "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_ilm/status" | jq '.'

echo "Policy Details:"
curl -s "http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_ilm/policy/logs-policy" | jq '.logs-policy.policy.phases | keys'

print_success "Elasticsearch ILM configuration completed successfully!"
echo ""
echo "Summary of configured policies:"
echo "- logs-policy: ${HOT_SIZE} hot size, ${HOT_AGE} hot age, ${RETENTION_DAYS}d retention"
echo "- application-logs-policy: 10GB hot size, 7d hot age, 90d retention with cold phase"
echo "- metrics-policy: 2GB hot size, 1d hot age, 14d retention"
echo ""
echo "To apply policies to existing indices, use:"
echo "curl -X PUT \"http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/your-index/_settings\" -H 'Content-Type: application/json' -d '{\"index.lifecycle.name\": \"logs-policy\"}'"