How to apply an ILM policy to an Elasticsearch index

Applying an Index Lifecycle Management (ILM) policy to an existing Elasticsearch index lets you bring retention and later phase actions under control without rebuilding the index or waiting for a new rollover generation.

ILM policies are stored in cluster state and attached through dynamic index settings such as index.lifecycle.name. Once a policy is assigned, Elasticsearch evaluates the index against the policy's phase definitions and runs supported actions when age or other conditions are met.

Current Elastic guidance is to apply a policy without a rollover action when attaching ILM directly to an existing index. If the index is still your active write target, attach the rollover policy through an index template and rollover alias instead. Existing indices keep their original creation date for phase timing, so a newly attached policy can move toward later phases immediately when the index is already older than a policy's min_age. On secured clusters, lifecycle inspection/removal needs ILM-related privileges and updating index.lifecycle.name also requires permission to change index settings.

Steps to apply an ILM policy to an Elasticsearch index:

Confirm the target policy exists and is suitable for an existing index.

$ curl -sS "http://localhost:9200/_ilm/policy/logs-existing-policy?pretty&filter_path=*.policy.phases"
{
  "logs-existing-policy" : {
    "policy" : {
      "phases" : {
        "warm" : {
          "min_age" : "7d",
          "actions" : {
            "readonly" : { }
          }
        },
        "delete" : {
          "min_age" : "30d",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    }
  }
}

Policies applied directly to an existing index should typically omit rollover. Use an index template with index.lifecycle.rollover_alias when the index is still receiving writes.

Secure clusters usually need authentication plus ILM read privileges to inspect policy definitions.

Check whether the index is already managed by ILM.

$ curl -sS "http://localhost:9200/logs-2026.04.01/_ilm/explain?pretty&filter_path=indices.*.index,indices.*.managed,indices.*.policy,indices.*.phase,indices.*.action,indices.*.step"
{
  "indices" : {
    "logs-2026.04.01" : {
      "index" : "logs-2026.04.01",
      "managed" : true,
      "policy" : "old-policy",
      "phase" : "new",
      "action" : "complete",
      "step" : "complete"
    }
  }
}

If managed is false, skip the removal step and apply the new policy directly.

On secured clusters, _ilm/explain requires index metadata visibility such as view_index_metadata.

Remove the existing policy before switching to another one.
```
$ curl -sS -X POST "http://localhost:9200/logs-2026.04.01/_ilm/remove?pretty"
{
  "has_failures" : false,
  "failed_indexes" : [ ]
}
```
Do not assign a new policy before removing the old one. Elastic warns that phase execution can silently fail if a managed index is pointed at a different policy without first removing the current assignment.

Removing ILM metadata during an in-progress action such as forcemerge can leave the index in an undesired state, so review the current phase first when the index is actively transitioning.
Apply the new policy name to the index settings.
```
$ curl -sS -H "Content-Type: application/json" -X PUT "http://localhost:9200/logs-2026.04.01/_settings?pretty" -d '{
  "index": {
    "lifecycle": {
      "name": "logs-existing-policy"
    }
  }
}'
{
  "acknowledged" : true
}
```
Age-based phases use the index's existing creation time. If the index is already older than the new policy's min_age threshold, ILM can progress toward later phases soon after the policy is attached.

Secure clusters need authentication and permission to update index settings for this call.
Read the index lifecycle settings to confirm the expected policy name is stored.
```
$ curl -sS "http://localhost:9200/logs-2026.04.01/_settings/index.lifecycle.name,index.lifecycle.rollover_alias?pretty"
{
  "logs-2026.04.01" : {
    "settings" : {
      "index" : {
        "lifecycle" : {
          "name" : "logs-existing-policy"
        }
      }
    }
  }
}
```
Only index.lifecycle.name appears here because this example policy does not use rollover. If the policy needs a rollover action, stop and apply it through an index template instead of attaching it directly to one existing index.

Verify ILM now manages the index under the new policy.

$ curl -sS "http://localhost:9200/logs-2026.04.01/_ilm/explain?pretty&filter_path=indices.*.index,indices.*.managed,indices.*.policy,indices.*.age,indices.*.phase,indices.*.action,indices.*.step"
{
  "indices" : {
    "logs-2026.04.01" : {
      "index" : "logs-2026.04.01",
      "managed" : true,
      "policy" : "logs-existing-policy",
      "age" : "432ms",
      "phase" : "new",
      "action" : "complete",
      "step" : "complete"
    }
  }
}

phase new with step complete means the policy is attached and Elasticsearch is waiting for the first phase transition condition to be met.