Would allow us to quickly identify the good from the bad. Could use it along with "grep -v INFO" and the like.

Could also add a label to debug logs if enabled.

Example:
Index example-000001 meets required days to rollover but is not larger than 10 gb. Skipping
Becomes:
INFO: Index example-000001 meets required days to rollover but is not larger than 10 gb. Skipping

If a large index is found support auto reindex

It would be great if the elastic-ilm support custom health checks with remediation based on client_info.json.

Example client info:

Example client info entry

# "custom_checks": {
#     "0": {
#     "check": "/bin/bash /opt/elastic_stack/scripts/verify_acuity_custom_service.sh",
#     "remediate": "/bin/bash /opt/elastic_stack/scripts/restart_acuity_custom_service.sh",
#     "schedule": "15",
#     "remediation_retries": "3",
#     }
# },

Schedule would be dynamically set per entry. Thoughts?

• Add support for health checks. Look for proper exit code
• Add support for remediation checks. Run if check fails to exit properly
• Add support for custom schedules per health check
• Add support for remediation retry so it doesn't keep trying to remediate indefinitely

The retention process should first check to see if the index in question is part of a recovery job. If so, it should ignore it. Otherwise it accidentally deletes the index causing it to cancel the restore job.

If an index is not part of a rollover or datastream support migration into one

Evaluate security ongoing

Support synchronizing index templates, visualizations, etc, between clusters

If an index does not have an index template, support notification

If an index has fields not in the index template, auto add them

Tasks can lockup other tasks which is outside the design of this tool. At a minimum, each main piece of elastic-ilm (retention, accounting, etc.) needs to have it's own thread.

This is solvable by changing the scheduler module and/or plain multithreading.

Add support for monitoring events such as:

• Logstash pipelines
• Data sources not sending logs
• Hardware CPU, Memory, Disk

If there are rollover indices that are not the current write alias for a rollover or data stream that have 0 docs, they should be deleted.