// PUT _ilm/policy/logstash_30m_candle_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "10GB",
            "max_age": "400d"   // 14 天滚动
          },
          "allocate": { "_tier_preference": "data_hot" }
        }
      },
      "warm": {
        "min_age": "650d",      // 60 天进入 warm
        "actions": {
          "allocate": { "_tier_preference": "data_warm" }
        }
      },
      "cold": {
        "min_age": "1000d",     // 180 天进入 cold
        "actions": {
          "allocate": { "_tier_preference": "data_cold" },
          "shrink": { "number_of_shards": 1 }
        }
      },
      "delete": {
        "min_age": "2000d"     // 3 年后删除
      }
    }
  }
}