elasticsearch/docs/reference/tab-widgets/ilm.asciidoc

// tag::fleet[]
{fleet} and {agent} use the following built-in lifecycle policies:

* `logs`
* `metrics`
* `synthetics`

You can customize these policies based on your performance, resilience, and
retention requirements.

To edit a policy in {kib}, open the main menu and go to **Stack Management >
Index Lifecycle Policies**. Click the policy you'd like to edit.

You can also use the <<ilm-put-lifecycle,update lifecycle policy API>>.

[source,console]
----
PUT _ilm/policy/logs
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_primary_shard_size": "50gb"
          }
        }
      },
      "warm": {
        "min_age": "30d",
        "actions": {
          "shrink": {
            "number_of_shards": 1
          },
          "forcemerge": {
            "max_num_segments": 1
          }
        }
      },
      "cold": {
        "min_age": "60d",
        "actions": {
          "searchable_snapshot": {
            "snapshot_repository": "found-snapshots"
          }
        }
      },
      "frozen": {
        "min_age": "90d",
        "actions": {
          "searchable_snapshot": {
            "snapshot_repository": "found-snapshots"
          }
        }
      },
      "delete": {
        "min_age": "735d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}
----
// end::fleet[]

// tag::custom[]
To create a policy in {kib}, open the main menu and go to **Stack Management >
Index Lifecycle Policies**. Click **Create policy**.

You can also use the <<ilm-put-lifecycle,update lifecycle policy API>>.

include::{es-repo-dir}/data-streams/set-up-a-data-stream.asciidoc[tag=ilm-policy-api-ex]
// end::custom[]