What are ilm-history and slm-history indices used for?

Elastic Stack Elasticsearch
,
1

I'm doing some cleanup on my cluster and saw that there are a couple of small system indices that I'm not sure for what they are used.

Those indices are mostly ilm-history-* , .ds-ilm-history-* , .slm-history-* and .ds-slm-history.

As the name made it clear, they are associated to the Index Lifecycle Management and Snapshot Lifecycle Management, but I'm not sure what is the use or if I can remove them.

One of most repeated recomendations from Elastic is to avoid to have lot of small indices and yet the Elasticsearch itself keeps creating those small indices.

Both slm-history-ilm-policy and ilm-history-ilm-policy are using the default settings for rollover with 30 days or 50 GB, the slm-history-ilm-policy has a delete phase after 90 days, but the ilm-history-ilm-policy does not have a delete phase.

My question is, what are these indices used for? It is safe to change the delete phase for something like 1 or 2 days?

2

About ilm-history there is not much in the documentation.

I was able to find this part on how to enable it and saying that this is enabled by default.

And also this blog post saying to use ILM History to troubleshoot ILM Issues, so, the ilm-history indices are only a record of the ilm actions and only exists for troubleshoot issues?

For slm-history I found just this part telling how to set it and again it is already enabled by default, but I didn't find any explanation about where it is used, I'm assuming that this is used only for troubleshoot issues, is this correct?

Will disabling the ilm-history and slm-history affect the ILM and SLM process?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

4

Thanks for the feedback! Confirmed, these indices just record historical ILM+SLM states same as are logged into Elasticsearch logs (so can be disabled if desired without disabling either feature).

From your feedback (thanks!), I've expanded related ILM content from my earlier linked blog: