[DOCS] Add ILM tutorial

[mellieA]

Summary

Added a walkthrough using ILM with filebeat indices

Closes #29363
[skip-ci]

Preview the tutorial

[elasticmachine]

Pinging @elastic/kibana-docs (Team:Docs)

[mellieA]

This is still a work in progress, I know I need to check on at least the following things:

• Does a custom policy requires more Filebeat changes
• Add a step to associate a custom policy with the index template
• Change the custom policy screenshot

[gchaps]

that are automatically performed

[gchaps]

Add ending period

[gchaps]

which > that

[gchaps]

Change bullet points to numbered steps.

1. Activate the warm phase.
2. Set either of the following:
   bullet list
3. In Select a node attribute ...

[gchaps]

Make this step 2 instead of a substep:

Set either of the following:

[gchaps]

I'd put this first because it is the default.

[gchaps]

In Select a node attribute to control shard allocation, set data:warm(2) to migrate shards to warm data nodes.

[gchaps]

Make this one step.

Activate the delete phase and set the Timing to 60 days.

[gchaps]

Combine.

1. Activate the warm phase and configure it as follows.

[gchaps]

2. Activate the delete phase and set the timing.

[mellieA]

@gchaps @DanRoscigno I made the changes recommended above and pushed a new commit.

I'm still waiting to see how my custom policy behaves when it rolls over in 3 days.

[mellieA]

@gchaps @DanRoscigno I verified that ILM behaves the way I expected with this new policy. I think this is ready for another review!

[gchaps]

Suggested change

	For example, you can set this in `elasticsearch.yml` for each data node:
	For example, you can set this in your `elasticsearch.yml` for each data node:

[gchaps]

Should this be step 1?

[gchaps]

This is hard to parse. Can you make it a series of substeps?
3. Configure the index to use the new policy.
a. In Index Lifecycle Policies, select your policy.
b....
c....

[jrodewig]

We maintain a list of attributes here: https://github.com/elastic/docs/blob/master/shared/attributes.asciidoc

Try to use those when possible. They ensure we can make docs-wide term changes easily.

Suggested change

	=== Tutorial: Use ILM to manage Filebeat time-based indices
	=== Tutorial: Use {ilm-init} to manage {filebeat} time-based indices

[jrodewig]

Suggested change

	With index lifecycle management (ILM), you can create policies to define actions
	With {ilm} ({ilm-init}), you can create policies to define actions

[mellieA]

I'm replacing an existing page, so I was leaving the old anchor in case it was referenced elsewhere. Do you still suggest to change it?

[jrodewig]

With index lifecycle management (ILM), you can create policies to define actions that are automatically performed against indices as they age.

This implies that ILM only works based on age, but we can also take actions based on index size or number of docs. More importantly, this doesn't really address the why of ILM. It helps you automatically manage your indices for performance and retention. You may want to consider reusing a sentence from https://www.elastic.co/guide/en/elasticsearch/reference/master/overview-index-lifecycle-management.html.

In this tutorial, you will use Kibana’s Index Lifecycle Policies to modify and create ILM policies.

Nit: I'd reword to avoid future tense if possible. Something like:

This tutorial shows you how to use use {kib}'s *Index Lifecycle Policies* to
create and change {ilm-init} policies.

The bolded Index Lifecycle Policies seemed unnecessary to me, but maybe that's just a Kibana docs style.

[gchaps]

Yep, it's a Kibana docs style.

[jrodewig]

We should use [discrete] instead of [float] when possible. I'd also add an explicit anchor here.

Suggested change

	[float]
	==== Scenario
	[discrete]
	[[example-using-index-lifecycle-policy-scenario]]
	==== Scenario

[jrodewig]

Suggested change

	You’ve been tasked with sending syslog files to an {es} cluster. This
	project has the following data retention guidelines for log data:
	You’re tasked with sending syslog files to an {es} cluster. This
	log data has the following data retention guidelines:

[jrodewig]

This is the first mention of hot-warm architecture.

If readers should be familiar with those concepts, maybe add a link to a conceptual doc in the introduction?

[jrodewig]

"Roll over" should be two words when used as a verb. One word as a noun.

Suggested change

	* Rollover to a new index if the size reaches 50GB
	* Roll over any index containing log data to a new index when it reaches 50GB

[jrodewig]

** Set replicas to 1
** Force merge indices to a single segment

I think these two items need more context/explanation. I imagine many users may not be familiar with the concept of replicas, force merges, or segments. At the least, provide a link.