# Looking for the best way to manage a somewhat "hot" and "warm" environment for indices

**URL:** <https://discuss.elastic.co/t/looking-for-the-best-way-to-manage-a-somewhat-hot-and-warm-environment-for-indices/287124>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [October 19, 2021, 4:41pm UTC](https://discuss.elastic.co/t/looking-for-the-best-way-to-manage-a-somewhat-hot-and-warm-environment-for-indices/287124 "2021-10-19T16:41:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gentle\_ghost](https://avatars.discourse-cdn.com/v4/letter/g/ea5d25/32.png) [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\
**Post date:** [October 19, 2021, 4:41pm UTC](https://discuss.elastic.co/t/looking-for-the-best-way-to-manage-a-somewhat-hot-and-warm-environment-for-indices/287124/1 "2021-10-19T16:41:00Z")

</div>

Hello,

First, thank you for your patience while I attempt to illustrate my issue. I hope I'm being coherent enough.

I am using Apache NiFi to route data into Elasticsearch. Data being ingested into Elasticsearch has indices dynamically created based on `hostname` + `log_type`. For example: 'host1\_syslog`. I'm only ingesting the current running message log in these instances. There are cases where we need to backfill message data. Doing so creates a monolithic index with historical data added.

What I'd like to do is separate the indices by current message data and historical data. Let say current message data is most recent 30 days. I could have the current message data going to `host1_syslog_current` and `host1_syslog_old` These could be aliased together ` host1_syslog` but I'm not sure how to handle the index lifecycle policy management for that. The ilm policy just controls the rollover per index. Is there a way to create an ilm policy that would have `host1_syslog_current` only contain 30 days worth of data and will rollover data/append older than 30 days to `host1_syslog_old`

Am I explaining this well enough?

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 19, 2021, 9:11pm UTC](https://discuss.elastic.co/t/looking-for-the-best-way-to-manage-a-somewhat-hot-and-warm-environment-for-indices/287124/2 "2021-10-19T21:11:49Z")

</div>

ILM isn't designed to do that, as the stack expects that you have a single alias to interact with the underlying indices with.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2021, 9:11pm UTC](https://discuss.elastic.co/t/looking-for-the-best-way-to-manage-a-somewhat-hot-and-warm-environment-for-indices/287124/3 "2021-11-16T21:11:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.