{"@timestamp":"2025-10-10T01:30:54.344Z", "log.level": "WARN", "message":"high disk watermark [90%] exceeded on [iYjn6nhrT-2vbYycA5rqIw][elasticsearch-es-default-0][/usr/share/elasticsearch/data] free: 9.5gb[9.5%], shards will be relocated away from this node; currently relocating away shards totalling [0] bytes; the node is expected to continue to exceed the high disk watermark when these relocations are complete", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch[elasticsearch-es-default-0][masterService#updateTask][T#61283]","log.logger":"org.elasticsearch.cluster.routing.allocation.DiskThresholdMonitor","elasticsearch.cluster.uuid":"j0uwAj-lTbCWO3z0IzpX6w","elasticsearch.node.id":"iYjn6nhrT-2vbYycA5rqIw","elasticsearch.node.name":"elasticsearch-es-default-0","elasticsearch.cluster.name":"elasticsearch"}

PUT _data_stream/logs-generic-default/_lifecycle
{
  "policy": "delete-after-14d"
}

PUT _ilm/policy/k8s-30d-delete
{
  "policy": {
    "phases": {
      "delete": {
        "min_age": "30d",
        "actions": { "delete": {} }
      }
    }
  }
}

PUT _index_template/k8s-template
{
  "index_patterns": ["k8s-*"],
  "template": {
    "settings": {
      "index.lifecycle.name": "k8s-30d-delete"
    }
  },
  "priority": 500
}