ILM 정책을 대체할 두 줄의 JSON: 데이터 스트림 라이프사이클이 프로즌 티어(Frozen Tier)를 지원합니다

5, frozen_after in data stream lifecycle moves indices to searchable snapshots on object storage on their own, keeping them queryable alongside downsampling and retention. Data stream lifecycle in Elasticsearch 9. 5 can move backing indices to the frozen tier as searchable snapshots on object storage, with no ILM policy required. Add frozen_after next to data_retention and optional downsampling in a few lines of JSON, or set it in Kibana. The feature is generally available in 9. frozen_after sits at the top level of the lifecycle, next to data_retention and downsampling .

That's the whole feature, at the API level. Indices in my-data-stream stay on hot for 30 days, then move to frozen for the remaining 60. After 90 days they're deleted, and the backing snapshot goes with them. It composes with the rest of the lifecycle, including downsampling: The order of values is enforced: frozen_after has to be less than data_retention and greater than any downsampling. The API rejects configurations that don't make physical sense. Frozen tier data is held as partially-mounted searchable snapshots, which means DLM needs a snapshot repository to write into.

Rather than make you choose a repository per lifecycle, 9. 5 introduces a cluster-level default snapshot repository . DLM uses this repository for every frozen tier index in the cluster. On Elastic Cloud Hosted (ECH), the default is pre-populated with found-snapshots so existing clusters work out of the box. You can change it to a repository you control if you'd rather keep your frozen data in a bucket you own (useful if you want object versioning, lifecycle backups to Glacier, or anything else that needs bucket-level access).

Wherever you can set frozen_after in Kibana, the UI shows the current default repository inline and links to the place to change it, so you can see where frozen data will be written. If the cluster doesn't have a default repository configured, you can still write a lifecycle with frozen_after . The API accepts it but returns a warning: The data stays on hot until a default repository is configured and exists. The same logic applies if the cluster lacks a valid Enterprise license. Errors are visible in the data stream lifecycle status API for that stream.