A delete phase is the final stage of an index lifecycle. After earlier phases complete, Elasticsearch permanently deletes the index, erases its data, and frees its resources. Because deletion is irreversible, take a snapshot first when the data may need future restoration. section 6.9.1 section 6.9.3
Delete an index after one day
Define a policy with a hot phase followed by delete: PUT _ilm/policy/hot_delete_policy { "policy": { "phases": { "hot": { "min_age": "1d", "actions": { "set_priority": { "priority": 250 } } }, "delete": { "actions": { "delete": {} } } } } } The hot phase waits one day and sets the index priority. The delete phase has no min_age, so deletion starts as soon as the hot actions finish. Attach the policy when creating an index: PUT hot_delete_policy_index { "settings": { "index.lifecycle.name": "hot_delete_policy" } } The index enters hot first, then transitions automatically to delete. section 6.9.2
A delete phase can also follow warm storage actions. For example, an index can roll over in hot, shrink to one shard in warm, remain in delete for 30 days, and then be removed. Use the delay when retention requires it; an immediate delete is suitable only for deliberately temporary data. section 6.9.3
