// PUT _ilm/policy/logstash_1m_candle_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "20GB",
            "max_age": "7d"    // 7 天滚动，频繁数据快速积累
          },
          "allocate": { "_tier_preference": "data_hot" }
        }
      },
      "warm": {
        "min_age": "30d",      // 30 天进入 warm
        "actions": {
          "allocate": { "_tier_preference": "data_warm" }
        }
      },
      "cold": {
        "min_age": "90d",      // 90 天进入 cold
        "actions": {
          "allocate": { "_tier_preference": "data_cold" },
          "shrink": { "number_of_shards": 1 }
        }
      },
      "delete": {
        "min_age": "365d"      // 1 年后删除
      }
    }
  }
}