I have ILM setup on my elasticsearch cluster and for the most part it seems to be working but I have a few questions on how things are working behind the scenes. Currently I have my settings identical to the examples in the documentation here: https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html
What I am trying to understand is what is actually causing ILM to trigger and fire off whatever my policy has it set to? Is it based on the index creation time? Additionally, I would like to understand how ILM works on indices that have already been created. For example, if I was to change my delete phase from 90 to 60 days would it clean up everything that is not covered by the new 60 day policy? If so when does this apply? If not, is there a way to force ILM to re-evaluate the indices that it have it applied and rerun the policy?