How to setup ILM in elastic search

Elastic Stack Elasticsearch
2

You read and write via the alias.

All indices will have the alias, so reading refers to all of them. Only one can have is_write_alias: True, so writes are directed to it.

Rollover creates a new index -nnnnnn + 1 then sets is_write_alias: True for the new index causing writes to move from the old index to the new.

You can PUT to create the new index without adding a document, From the manual:

PUT datastream-000001
{
  "aliases": {
    "datastream": {
      "is_write_index": true
    }
  }
}