Downsample

Phases allowed: hot, warm, cold.

Aggregates a time series (TSDS) index and stores pre-computed statistical summaries (min, max, sum, and value_count) for each metric field grouped by a configured time interval. For example, a TSDS index that contains metrics sampled every 10 seconds can be downsampled to an hourly index. All documents within an hour interval are summarized and stored as a single document and stored in the downsample index.

This action corresponds to the downsample API.

The name of the resulting downsample index is downsample-<original-index-name>-<random-uuid>. If ILM performs the downsample action on a backing index for a data stream, the downsample index becomes a backing index for the same stream and the source index is deleted.

To use the downsample action in the hot phase, the rollover action must be present. If no rollover action is configured, ILM will reject the policy.

fixed_interval

(Required, string) The fixed time interval into which the data will be downsampled.

force_merge_index Stack 9.3+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

(Optional, boolean) When true, the downsampled index will be force merged to one segment. Defaults to true.

sampling_method Stack 9.3+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

(Optional, string) The sampling method that will be used to sample metrics; there are two methods available aggregate and the last_value. Defaults to aggregate.

PUT _ilm/policy/datastream_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_docs": 1
          },
          "downsample": {
  	          "fixed_interval": "1h",
  	          "force_merge_index": false
  	      }
        }
      }
    }
  }
}