Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
8836b54
Adding Streams information into the Manage data section
yetanothertw Oct 8, 2025
2996bbb
Changed section to admonition
yetanothertw Oct 8, 2025
3c706c5
adding more applies_to tags
yetanothertw Oct 8, 2025
dc81d2c
trying diff tagging
yetanothertw Oct 8, 2025
55e9940
another attempt to add multiple tags in note
yetanothertw Oct 8, 2025
6ab5411
fixing tags per Fabri's example
yetanothertw Oct 8, 2025
7a2c96d
Add section about managing data retention in Streams
yetanothertw Oct 8, 2025
4eaa1f3
minor update to include new section in the tutorial context
yetanothertw Oct 8, 2025
62ed5a6
Updating the configure data stream retention tutorial
yetanothertw Oct 9, 2025
f2d0f94
Adding mentions of streams in the failure store for data stream doc
yetanothertw Oct 9, 2025
ea3f6f2
minor edits fot the modify ds page
yetanothertw Oct 10, 2025
b8a2f4e
Minor improvements suggested by David
yetanothertw Oct 10, 2025
e48257a
Adding steps to view a data stream's lifecycle in streams
yetanothertw Oct 10, 2025
cce95b3
add link to streams
yetanothertw Oct 10, 2025
44f28f5
Adding a section for managing data streams in Streams
yetanothertw Oct 10, 2025
380e50a
Merge branch 'main' into streams-274-md
yetanothertw Oct 10, 2025
a4cd59c
Add note about managing data retention in stream to the remaining DLM…
yetanothertw Oct 10, 2025
7722d3c
Merge branch 'main' into streams-274-md
yetanothertw Oct 20, 2025
d81a06a
Making some final revisions
yetanothertw Oct 21, 2025
b886395
Review feedback
yetanothertw Oct 22, 2025
7416006
Merge branch 'main' into streams-274-md
yetanothertw Oct 22, 2025
a32641a
Add links to the Obs content
yetanothertw Oct 22, 2025
2acaa78
One more link
yetanothertw Oct 22, 2025
6d981d0
Fix link to anchor
yetanothertw Oct 22, 2025
87908b8
Merge branch 'main' into streams-274-md
yetanothertw Oct 22, 2025
2056edb
Merge branch 'main' into streams-274-md
yetanothertw Oct 22, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions manage-data/data-store/data-streams.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,16 @@ A data stream acts as a layer of abstraction over a set of indices that are opti

You can submit indexing and search requests directly to a data stream. The stream automatically routes the request to backing indices that store the stream’s data. You can use [{{ilm}} ({{ilm-init}})](../lifecycle/index-lifecycle-management.md) to automate the management of these backing indices. For example, you can use {{ilm-init}} to automatically move older backing indices to less expensive hardware and delete unneeded indices. {{ilm-init}} can help you reduce costs and overhead as your data grows.

You can also use a [data stream lifecycle](../lifecycle/data-stream.md) to automate lifecycle management according to your retention requirements.

:::{admonition} Managing data streams with Streams
:applies_to: {"stack": "ga 9.2, preview 9.1", "serverless": "ga"}

Starting with {{stack}} version 9.2, the [**Streams**](/solutions/observability/streams/streams.md) page provides a centralized interface for managing your data in {{kib}}. It consolidates common data management tasks and eliminates the need for manual configuration of multiple applications and components. A stream maps directly to an {{es}} data stream, for example `logs-myapp-default`. Any changes that you make on the **Streams** page are automatically propagated to the associated data stream.

For more information, refer to [Manage data streams with Streams](/manage-data/data-store/data-streams/manage-data-stream.md#manage-data-streams-with-streams).

:::

## Should you use a data stream? [should-you-use-a-data-stream]

Expand Down
6 changes: 6 additions & 0 deletions manage-data/data-store/data-streams/failure-store.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,12 @@ PUT _data_stream/my-datastream-existing/_options

1. Redirecting failed documents into the failure store will now be disabled.

:::{tip}
:applies_to: {"stack": "ga 9.2, preview 9.1", "serverless": "ga"}

You can also enable the data stream failure store in {{kib}}. Locate the data stream on the **Streams** page, where a stream maps directly to a data stream. Select a stream to view its details and go to the **Retention** tab where you can find the **Enable failure store** option.
:::

### Enable failure store via cluster setting [set-up-failure-store-cluster-setting]

If you have a large number of existing data streams you may want to enable their failure stores in one place. Instead of updating each of their options individually, set `data_streams.failure_store.enabled` to a list of index patterns in the [cluster settings](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings). Any data streams that match one of these patterns will operate with their failure store enabled.
Expand Down
23 changes: 22 additions & 1 deletion manage-data/data-store/data-streams/manage-data-stream.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,4 +21,25 @@ In {{es-serverless}}, indices matching the `logs-*-*` pattern use the logsDB ind

* To view more information about a data stream, such as its generation or its current index lifecycle policy, click the stream’s name. From this view, you can navigate to **Discover** to further explore data within the data stream.
* To view information about the stream’s backing indices, click the number in the **Indices** column.
* To modify the data retention value, select a data stream, open the **Manage** menu, and click **Edit data retention**.
* To modify the data retention value, select a data stream, open the **Manage** menu, and click **Edit data retention**.

## Manage data streams with Streams [manage-data-streams-with-streams]
```{applies_to}
serverless: ga
stack: preview 9.1, ga 9.2
```
Starting with {{stack}} version 9.2, the [**Streams**](/solutions/observability/streams/streams.md) page provides a centralized interface for managing your data in {{kib}}. It consolidates common data management tasks and eliminates the need for manual configuration of multiple applications and components. A stream maps directly to an {{es}} data stream, for example `logs-myapp-default`. Any changes that you make on the **Streams** page are automatically propagated to the associated data stream.

:::{image} /manage-data/images/data-stream-management-streams.png
:alt: The Streams page
:screenshot:
:::


You can perform the following data management tasks on the **Streams** page:
* [define parsing and field extraction logic](/solutions/observability/streams/management/extract.md)
* [configure data retention policies](/solutions/observability/streams/management/retention.md)
* [manually adjust index settings](/solutions/observability/streams/management/advanced.md)
* [manage and update field mappings](/solutions/observability/streams/management/schema.md) {applies_to}`stack: unavailable 9.1`
* [identify failed and degraded documents](/solutions/observability/streams/management/data-quality.md) {applies_to}`stack: unavailable 9.1`
* [partition data into child streams](/solutions/observability/streams/management/partitioning.md) {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview`
19 changes: 19 additions & 0 deletions manage-data/data-store/data-streams/modify-data-stream.md
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,11 @@ To add a mapping for a new field to a data stream, following these steps:
```


:::{tip}
:applies_to: {"stack": "ga 9.2, preview 9.1", "serverless": "ga"}

You can also add a new field mapping to a data stream in {{kib}}. Locate the data stream on the **Streams** page where a stream maps directly to a data stream. Select a stream to view its details and go to the **Schema** tab to add a new field.
:::

### Change an existing field mapping in a data stream [change-existing-field-mapping-in-a-data-stream]

Expand Down Expand Up @@ -168,6 +173,12 @@ The documentation for each [mapping parameter](elasticsearch://reference/elastic
```


:::{tip}
:applies_to: {"stack": "ga 9.2, preview 9.1", "serverless": "ga"}

You can also update an existing field's mapping in {{kib}}. Locate the data stream on the **Streams** page where a stream maps directly to a data stream. Select the stream to view its details and go to the **Schema** tab to make your updates. For more information, refer to [](/solutions/observability/streams/management/schema.md).
:::

Except for supported mapping parameters, we don’t recommend you change the mapping or field data type of existing fields, even in a data stream’s matching index template or its backing indices. Changing the mapping of an existing field could invalidate any data that’s already indexed.

If you need to change the mapping of an existing field, create a new data stream and reindex your data into it. See [Use reindex to change mappings or settings](../data-streams/modify-data-stream.md#data-streams-use-reindex-to-change-mappings-settings).
Expand Down Expand Up @@ -218,6 +229,14 @@ To change the `index.lifecycle.name` setting, first use the [remove policy API](
::::


:::{tip}
:applies_to: {"stack": "ga 9.2, preview 9.1", "serverless": "ga"}

You can also update certain dynamic index settings for a data stream in {{kib}}, such as the number of shards, replicas, and the refresh interval used.

Locate the data stream on the **Streams** page where a stream maps directly to a data stream. Select the stream to view its details and go to the **Advanced** tab to make your adjustments. For more information, refer to [](/solutions/observability/streams/management/advanced.md#streams-advanced-index-config).
:::

### Change a static index setting for a data stream [change-static-index-setting-for-a-data-stream]

[Static index settings](elasticsearch://reference/elasticsearch/index-settings/index.md) can only be set when a backing index is created. You cannot update static index settings using the [update index settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-settings).
Expand Down
6 changes: 6 additions & 0 deletions manage-data/data-store/index-basics.md
Original file line number Diff line number Diff line change
Expand Up @@ -153,6 +153,12 @@ In {{es-serverless}}, indices matching the `logs-*-*` pattern use the logsDB ind
* To modify the data retention value, select a data stream, open the **Manage** menu, and click **Edit data retention**. On {{stack}}, this action is only available if your data stream is not managed by an ILM policy.
* To view more information about a data stream including it's lifecycle settings, click the stream's name.

:::{admonition} Streams
:applies_to: {"stack": "ga 9.2, preview 9.1", "serverless": "ga"}

Starting with {{stack}} version 9.2, the [**Streams**](/solutions/observability/streams/streams.md) page provides a centralized interface for common data management tasks in {{kib}}, including tasks such as [modifying data retention](/manage-data/lifecycle/data-stream/tutorial-update-existing-data-stream.md#data-retention-streams) values.
:::

### Manage index templates [index-management-manage-index-templates]

An index template is a type of [template](/manage-data/data-store/templates.md) that tells {{es}} how to configure an index when it is created.
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ products:

# Tutorial: Configure data stream retention [tutorial-manage-data-stream-retention]

In this tutorial, we are going to go over the data stream lifecycle retention; we will define it, go over how it can be configured and how it can gets applied. Keep in mind, the following options apply only to data streams that are managed by the data stream lifecycle.
This tutorial demonstrates lifecycle retention, showing how to define, configure, and apply it. Keep in mind that the following options apply only to data streams that are managed by the data stream lifecycle.

1. [What is data stream retention?](#what-is-retention)
2. [How to configure retention?](#retention-configuration)
Expand Down Expand Up @@ -42,6 +42,11 @@ The result should look like this:
2. Ensure that the lifecycle is enabled, meaning this should be `true`.


:::{tip}
:applies_to: {"stack": "ga 9.2, preview 9.1", "serverless": "ga"}

You can also review how a data stream is managed by locating it on the **Streams** page in {{kib}}. A stream directly corresponds to a data stream. Select a stream to view its details and go to the **Retention** tab.
:::

## What is data stream retention? [what-is-retention]

Expand All @@ -67,9 +72,9 @@ Global default and max retention do not apply to data streams internal to elasti

## How to configure retention? [retention-configuration]

* By setting the `data_retention` on the data stream level. This retention can be configured in two ways:
* Configure data retention at the data stream level using the `data_retention` setting. You can do this in two ways:

For new data streams, it can be defined in the index template that would be applied during the data stream’s creation. You can use the [create index template API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-index-template), for example:
* For a new data stream, the `data_retention` setting can be included in the index template that is applied when the data stream is created. You can use the [create index template API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-index-template), for example:

```console
PUT _index_template/template
Expand All @@ -88,7 +93,7 @@ Global default and max retention do not apply to data streams internal to elasti
}
```

For an existing data stream, it can be set via the [PUT lifecycle API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-data-lifecycle).
* For an existing data stream, the `data_retention` setting can be configured using the [PUT lifecycle API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-data-lifecycle).

```console
PUT _data_stream/my-data-stream/_lifecycle
Expand All @@ -99,7 +104,13 @@ Global default and max retention do not apply to data streams internal to elasti

1. The retention period of this data stream is set to 30 days.

* By setting the global retention via the `data_streams.lifecycle.retention.default` and/or `data_streams.lifecycle.retention.max` that are set on a cluster level. You can be set via the [update cluster settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings). For example:
:::{tip}
:applies_to: {"stack": "ga 9.2, preview 9.1", "serverless": "ga"}

To adjust the retention period of a data stream in {{kib}}, locate a data stream on the **Streams** page. A stream maps directly to a data stream. Next, select a stream to view its details and review the **Retention** tab to find out how it's managed before making your adjustments.
:::

* By setting the global retention via the `data_streams.lifecycle.retention.default` and/or `data_streams.lifecycle.retention.max` that are applied on a cluster level. You can set these via the [update cluster settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings). For example:

```console
PUT /_cluster/settings
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,14 @@ products:
In this tutorial we’ll look at migrating an existing data stream from [Index Lifecycle Management ({{ilm-init}})](../index-lifecycle-management.md) to [data stream lifecycle](../data-stream.md). The existing {{ilm-init}} managed backing indices will continue to be managed by {{ilm-init}} until they age out and get deleted by {{ilm-init}}; however, the new backing indices will be managed by data stream lifecycle. This way, a data stream is gradually migrated away from being managed by {{ilm-init}} to being managed by data stream lifecycle. As we’ll see, {{ilm-init}} and data stream lifecycle can co-manage a data stream; however, an index can only be managed by one system at a time.


To migrate a data stream from {{ilm-init}} to data stream lifecycle we’ll have to execute two steps:
:::{admonition} Configure data retention policies for Streams
:applies_to: {"stack": "ga 9.2, preview 9.1", "serverless": "ga"}

Starting with {{stack}} version 9.2, the [**Streams**](/solutions/observability/streams/streams.md) page provides a centralized interface for common data management tasks in {{kib}}, including tasks such as configuring data retention policies. You can choose to retain your data indefinitely, for a custom period, or by following an existing ILM policy. For more information, refer to [Manage data retention in Streams](/manage-data/lifecycle/data-stream/tutorial-update-existing-data-stream.md#data-retention-streams).

:::

To migrate a data stream from {{ilm-init}} to data stream lifecycle using APIs you need to run two steps:

1. Update the index template that’s backing the data stream to set [prefer_ilm](elasticsearch://reference/elasticsearch/configuration-reference/data-stream-lifecycle-settings.md#index-lifecycle-prefer-ilm) to `false`, and to configure data stream lifecycle.
2. Configure the data stream lifecycle for the *existing* data stream using the [lifecycle API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-data-lifecycle).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ Follow these steps to configure or remove data stream lifecycle settings for an

- [Set a data stream’s lifecycle](#set-lifecycle)
- [Remove the lifecycle for a data stream](#delete-lifecycle)
- [Manage data retention with Streams](#data-retention-streams)

Note that these steps are for data stream lifecycle only. For the steps to configure {{ilm}}, refer to the [{{ilm-init}} documentation](/manage-data/lifecycle/index-lifecycle-management.md). For a comparison between the two, refer to [](/manage-data/lifecycle.md).

Expand Down Expand Up @@ -212,4 +213,20 @@ GET .ds-my-data-stream-*/_lifecycle/explain
3. The name of another backing index.
4. Indication that the index is not managed by the data stream lifecycle.
:::
:::::
:::::

## Manage data retention with Streams [data-retention-streams]
```{applies_to}
serverless: ga
stack: preview 9.1, ga 9.2
```

Starting with {{stack}} version 9.2, the **Streams** page provides a centralized interface for common data management tasks in {{kib}}, including getting insight into how your data streams retain data.

1. Go to the **Streams** page using the navigation menu or the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
1. Each stream maps directly to an {{es}} data stream. Select a stream to view its details.
1. Go to the **Retention** tab to set how long your stream retains data and to get insight into your stream's data ingestion and storage size.
1. Select **Edit data retention** and choose to retain your data indefinitely, for a custom period, or by following an existing ILM policy. You can also use the data retention configuration that's set in the index template by enabling the **Inherit from index template** option. If you use this option, you don't need to specify a custom retention period or policy.

For more information about the retention configuration options, refer to [](/solutions/observability/streams/management/retention.md).

Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,16 @@ To learn how to create a specialized ILM policy for any data stream, such as tho
1. Select the data stream to view details. The flyout that opens includes direct links to the ILM policy and the index template.

![Data stream status page](/manage-data/images/elasticsearch-reference-datastream-status.png "")


**To view the current lifecycle status for a datastream on the Streams page:** {applies_to}`"stack": "ga 9.2, preview 9.1"`

Starting with {{stack}} version 9.2, the [**Streams**](/solutions/observability/streams/streams.md) page provides a centralized interface for common data management tasks in {{kib}}.

1. Go to the **Streams** page using the navigation menu or the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
1. A stream maps directly to an {{es}} data stream. Select a stream to view its details.
1. Go to the **Retention** tab to see how long your stream retains data and to get insight into your stream's data ingestion and storage size. A stream can retain the data indefinitely, for a custom period, or by following an existing ILM policy. For more information, refer to [](/solutions/observability/streams/management/retention.md).

::::

:::{tab-item} API
Expand Down