Get started with ISM (Index State Management) – Technology Security Information

To start with Index State Management, first of all, you need to set up policies.
You can use Visual Editor or Dev-tools. If you choose Visual Editor, then do the following:
In Index Management > State management policies, choose Create policy and click Continue:

Inside the Create policy, you need to set the policy info:

Policy ID
Description (optional)

Set Error notifications (optional): This helps you react faster when something goes wrong. The notifications can be sent via Slack, mail, etc.

If you don’t have any channels for notification, then create one:

Click on Manage channels, and in the new tab, you will see a list of Channels.
Then, you need to click on Create channel and create your channel to send the error notification. For example, on the screenshot, I chose Slack.
Now you can see your channel in a list.

Now you can set a channel for Error notification. If you want, you can change the default error message.

In ISM templates, you need to set your Index patterns. But before that, you need to create an index and a template for it.

To create an index, you need to use the following command in Dev Tools.

If you want a yearly index, use this command:

PUT %3Ctest_index-%7Bnow%2FM%7Byyyy%7D%7D-000001%3E 
{
	"aliases": {
		"'test_index'": {
			"is_write_index": true
		}
	}
}

If you want a monthly index, use this command:

PUT %3Ctest_index-%7Bnow%2FM%7Byyyy.MM%7D%7D-000001%3E 
	{
		"aliases": {
			"'test_index'": {
				"is_write_index": true
			}
		}
	}

If you want a daily index, use this command:

PUT %3Ctest_index-%7Bnow%2Fd%7D-000001%3E 
{
	"aliases": {
		"'test_index'": {
			"is_write_index": true
		}
	}
}

Also, you can use this without any time markers:

PUT %3Ctest_index-000001%3E
{
	"aliases": {
		"'test_index'": {
			"is_write_index": true
		}
	}
}

To create a template for it, you need to use this command in Dev Tools:

PUT _template/custom-test
{
		"order": 1,
		"index_patterns": [
			"test_index-*"
		],
		"settings" : {
			"index.opendistro.index_state_management.policy_id": "test",
			"index.opendistro.index_state_management.rollover_alias": "test_index",
			"number_of_replicas":"1",
			"refresh_interval": "30s"
		}
	}

Set States

Click Add State, and then you will see the Create State window. In the State name, you need to set the name. If this is your first state, then the Order will not be active.

Then, you need to add an action by choosing it from the drop-down. For example, in the screenshot, I chose Rollover to automate the creation of a new index when the index is in a certain state. I set:

Minimum index age to 1d because I want to create a new index every day.
Minimum index size to 50gb. If the index is bigger than 50GB, then a new index is created.

Finally, click Add action.

Now you can see it in Actions.

Click Save state.

Now, you can configure automatic index deletion when a certain condition is met.
For example, in the screenshot I need to delete the index when its age is more than 10 days.
For this:
You need to again click Add state, then Add action, and choose Delete from the drop-down list.
Now Order is active and you can see it will added after the first stage (test)
click Save stage.