add --hidden flag (default off) to 'index ls' and 'ilm forecast ls' (#55)

README.md

@@ -56,99 +56,58 @@ Features:
   esctl doc add -i foo '{"title":"curry in a hurry", "message":"australian thai"}'
   ```
 
-## Usage
+## Installation
 
-Command tree:
+The tool does not have any dependencies.  Just download the binary for
+your platform from the releases page and you're good to go.
 
-```console
-api                   - api access and documentation
-  list                - list index of API calls
-  show                - show an API doc
-  repl                - interactive API repl
-ccr                   - manage cross cluster replication
-  status              - cross cluster replication status (yaml config with 2 clusters required)
-  pause               - pause shard allocation
-  resume              - resume shard allocation
-  follower            - manage ccr follower indices
-    show              - show ccr follower index details
-    add               - add ccr follower index
-    delete            - delete ccr follower index
-    unfollow          - unfollow ccr follower index
-    pause             - pause ccr index to follow
-    resume            - resume ccr index to follow
-    renew             - renew ccr follower index
-  info                - show ccr remote info
-cluster               - manage cluster[s]
-  status              - show cluster status
-  switch              - set current elasticsearch cluster
-  list                - list configured clusters
-  settings            - cluster settings management
-    list              - show cluster settings
-    set               - set|update cluster settings
-datastream            - manage data streams
-  list                - list indicies
-  show                - show details about an data stream
-  create              - create a new data stream
-  delete              - delete a data stream
-  rollover            - roll over a data stream
-doc                   - manage documents
-  add                 - add JSON document index
-  show                - show a JSON document
-  delete              - delete JSON document[s] from index[es]
-ilm                   - manage index lifecycle
-  retry               - retry applying an ILM profile to an index
-  status              - get the current index lifecycle management status
-  list                - list index lifecycle policies
-  show                - show details about an index lifecycle policy
-  create              - create a index lifecycle policy
-index                 - manage indicies
-  list                - list indicies
-  show                - show details about an index
-  create              - create a new index
-  delete              - delete an index
-  close               - close an index
-  allocation          - explain index allocation
-  modify              - modify an index
-  fields              - show info about field capabilities
-  ilm                 - show ilm status
-  alias               - manage index aliases
-    create            - create an index alias
-    list              - list index aliases
-    delete            - delete an index alias
-    rollover          - roll over an index alias
-  template            - manage index templates
-    list              - list index templates
-    show              - show details about an index template
-    create            - create a new index template
-    modify            - modify a new index template
-    delete            - delete an index template
-node                  - manage nodes
-  list                - list nodes
-  show                - show details about a node
-role                  - manage roles
-  list                - list roles
-  show                - show details about a role
-  diff                - show differences between roles and CSV baseline
-search                - search within an index
-shard                 - manage shards
-  list                - list shards
-  show                - show details about a shard
-snapshot              - manage snapshots
-  list                - list snapshots
-  show                - show details about a snapshot
-task                  - manage tasks
-  list                - list tasks
-  cancel              - cancel running task
-version               - show esctl version information
-debug                 - developer only
-help-jsonpath         - show jsonpath help
-completion            - Output shell completion script for bash, zsh, fish, or Powershell
-  bash                - Output bash completion script
-  zsh                 - Output zsh completion script
-  fish                - Output fish completion script
-  pwsh                - Output pwsh completion script
+### Installation using a pre-compiled binary
+
+You can use [stew](https://github.com/marwanhawari/stew) to install esctl:
+```default
+stew install https://codeberg.org/scip/esctl
 ```
 
+Or go to the [latest release page](https://codeberg.org/scip/esctl/releases/)
+and look for your OS and platform. There are two options to install the binary:
+
+Directly     download     the     binary    for     your     platform,
+e.g. `esctl-linux-amd64-0.0.2`, rename it to `esctl` (or whatever
+you like more!)  and put it into  your bin dir (e.g. `$HOME/bin` or as
+root to `/usr/local/bin`).
+
+Be sure  to verify  the signature  of the binary  file. For  this also
+download the matching `esctl-linux-amd64-0.0.2.sha256` file and:
+
+```shell
+cat esctl-linux-amd64-0.0.2.sha25 && sha256sum esctl-linux-amd64-0.0.2
+```
+You should see the same SHA256 hash.
+
+You  may  also download  a  binary  tarball  for your  platform,  e.g.
+`esctl-linux-amd64-0.0.2.tar.gz`,  unpack and  install it.  GNU Make  is
+required for this:
+   
+```shell
+tar xvfz esctl-linux-amd64-0.0.2.tar.gz
+cd esctl-linux-amd64-0.0.2
+sudo make install
+```
+
+### Installation from source
+
+Check out the repository and execute `go build`, then copy the
+compiled binary to your `$PATH`.
+
+Or, if you have GNU Make installed, just execute:
+
+```default
+make
+sudo make install
+```
+
+## Configure
+
 Configure `esctl` with environment variables:
 
 - `ES_URI`: elasticsearch uri
@@ -199,59 +158,377 @@ The following rules apply for default cluster selection:
 
 1. If there's just one cluster configured (either via environment
    variables or config), this one will be selected.
-2. If there is one cluster configured with the `default` flag `true`,
+2. If a cluster have been specified with `-C <name>`, use this.
+3. If there is one cluster configured with the `default` flag `true`,
    use this one.
    
-Use `esctl cluster ls` to check status and see which one would be used.
+Use `esctl cluster ls` to check status and see which one would be
+used.
 
-## Installation
+Please be aware, that prior to use a cluster and send API requests to
+it, `esctl` checks the connectivity to it first.
 
-The tool does not have any dependencies.  Just download the binary for
-your platform from the releases page and you're good to go.
+## Usage
 
-### Installation using a pre-compiled binary
+Once you have configured one or more (and marked one as the default,
+see above) elasticsearch clusters, you can start using `esctl`. Since
+there are just too many things you can do with it, we'll just outline
+a couple of examples here.
 
-You can use [stew](https://github.com/marwanhawari/stew) to install esctl:
-```default
-stew install https://codeberg.org/scip/esctl
+To see the status of a cluster:
+
+```console
+$ esctl cluster status 
+DEFAULT                    STATUS                 
+Cluster Name               eck-cluster-dev-s1
+ES Status                  green                  
+ES Version                 9.4.2                  
+Is Leader                  true                   
+Active Shards              447                    
+Active Primary Shards      221                    
+Unassigned Shards          0                      
+Unassigned Primary Shards  0                      
+Pending Tasks              0                      
+Nodes                      3                      
+Red Indices                0                      
+Long Running Tasks         2 
 ```
 
-Or go to the [latest release page](https://codeberg.org/scip/esctl/releases/)
-and look for your OS and platform. There are two options to install the binary:
+you may also add the `-v` flag to see more:
 
-Directly     download     the     binary    for     your     platform,
-e.g. `esctl-linux-amd64-0.0.2`, rename it to `esctl` (or whatever
-you like more!)  and put it into  your bin dir (e.g. `$HOME/bin` or as
-root to `/usr/local/bin`).
-
-Be sure  to verify  the signature  of the binary  file. For  this also
-download the matching `esctl-linux-amd64-0.0.2.sha256` file and:
-
-```shell
-cat esctl-linux-amd64-0.0.2.sha25 && sha256sum esctl-linux-amd64-0.0.2
-```
-You should see the same SHA256 hash.
-
-You  may  also download  a  binary  tarball  for your  platform,  e.g.
-`esctl-linux-amd64-0.0.2.tar.gz`,  unpack and  install it.  GNU Make  is
-required for this:
-   
-```shell
-tar xvfz esctl-linux-amd64-0.0.2.tar.gz
-cd esctl-linux-amd64-0.0.2
-sudo make install
+```console
+$ esctl cluster status -v
+DEFAULT                    STATUS                              
+Cluster Name               eck-cluster-dev-s1             
+ES Status                  green                               
+ES Version                 9.4.2                               
+Is Leader                  true                                
+Active Shards              447                                 
+Active Primary Shards      221                                 
+Unassigned Shards          0                                   
+Unassigned Primary Shards  0                                   
+Pending Tasks              0                                   
+Nodes                      3                                   
+Red Indices                0                                   
+Long Running Tasks         2                                   
+Indicies                   221                                 
+Docs                       9854777                             
+Total Size                 3.4 GB                              
+Total Queries              4210411                             
+Shards Primaries           824642680872                        
+Shards Total               824642680808                        
+Storage                    6.9 GB/6.9 GB                       
+JVM Heap Memory            16 GB/39 GB                         
+JVM Threads                458                                 
+JVM Version                OpenJDK 64-Bit Server VM 26.0.1+8-34
+CPUs                       18                                  
+CPU Usage                  0%                                  
+Open FDs                   1423 
 ```
 
-### Installation from source
+View cluster settings:
 
-Check out the repository and execute `go build`, then copy the
-compiled binary to your `$PATH`.
+```console
+$ esctl cluster settings list 
+SETTING                                         VALUE              
+cluster.remote.svct13.mode                      proxy              
+cluster.remote.svct13.proxy_address             100.127.161.24:9300
+cluster.remote.svct13.proxy_socket_connections  18                 
+cluster.remote.svct13.skip_unavailable          false              
+cluster.routing.allocation.enable               all                
+indices.recovery.max_bytes_per_sec              320mb 
+```
 
-Or, if you have GNU Make installed, just execute:
+Settings can be changed, use json path to specify a setting:
 
-```default
-make
-sudo make install
+```console
+$ esctl cluster settings set indices.recovery.max_bytes_per_sec:480mb
+```
+
+Searching is pretty easy. First check which indices exist:
+
+```console
+$ esctl index ls                                         
+NAME                                             SIZE     DOCSCOUNT
+[..]
+foo                                              249b     0        
+foo2                                             31.4kb   14       
+mock                                             9.6kb    20       
+mr-strange                                       249b     0        
+silo18                                           5.2kb    1 
+```
+
+Like a dataview in kibana you can specify an index pattern for search:
+
+```console
+$ esctl search -i foo*
+{"id":"1779873299", "score":1.0000, "index":"foo2", "source":{"message":"foo bar"}}{"id":"1779870997", "score":1.0000, "index":"foo2", "source":{"message":"start","time":"27.05.2026T10:55:33+0200","title":"zeitbuchung"}}{"id":"1779870750", "score":1.0000, "index":"foo2", "source":{"message":"pause","time":"27.05.2026T10:33:45+0200","title":"zeitbuchung"}}{"id":"1779870103", "score":1.0000, "index":"foo2", "source":{"message":"punktlich gebucht","time":"27.05.2026T10:20:01+0200","title":"zeitbuchuung"}}{"id":"1779432806", "score":1.0000, "index":"foo2", "source":{"message":"strange compound 2"}}{"id":"1779432750", "score":1.0000, "index":"foo2", "source":{"message":"strange compound 1"}}{"id":"1778600947", "score":1.0000, "index":"foo2", "source":{"id":"d8d8d","user":"scip"}}{"id":"1778600945", "score":1.0000, "index":"foo2", "source":{"id":"d8d8d","user":"scip"}}{"id":"1778600857", "score":1.0000, "index":"foo2", "source":{"id":"d8d8d","user":"scip"}}{"id":"1778601788", "score":1.0000, "index":"foo2", "source":{"id":"new1","message":"live long and prosper"}}{"id":"1778601422", "score":1.0000, "index":"foo2", "source":{"id":"new1","message":"love long and prosper"}}{"id":"1779447242", "score":1.0000, "index":"foo2", "source":{"message":"australian thai","title":"curry in a hurry"}}{"id":"1779447284", "score":1.0000, "index":"foo2", "source":{"message":"german killer food","title":"wuerger burger"}}{"id":"1779364394", "score":1.0000, "index":"foo2", "source":{"id":"1","message":"non-dead human looks curious at TargetOne"}}
+```
+
+Oops, that looks gibberish. It's because `esctl` just prints the raw
+JSON search results. There are multiple ways to post-process them:
+
+You can use `jq` (here, we're using `-l 1` to limit the output to 1 document):
+
+```console
+$ esctl search -i foo* -l 1 | jq
+{
+  "id": "1779364394",
+  "score": 1.0000,
+  "index": "foo2",
+  "source": {
+    "id": "1",
+    "message": "non-dead human looks curious at TargetOne"
+  }
+}
+```
+
+However, you might as well use internal filtering using jsonpaths:
+
+```console
+$ esctl search -i foo* -l 1 -p source.message
+non-dead human looks curious at TargetOne
+```
+
+To get more help about internal jsonpath filtering, run `esctl
+help-jsonpath`.
+
+A full text search looks like this:
+
+```console
+$ esctl search -i foo* thai | jq
+{
+  "id": "1779447242",
+  "score": 2.3842,
+  "index": "foo2",
+  "source": {
+    "message": "australian thai",
+    "title": "curry in a hurry"
+  }
+}
+```
+
+Instead of a costly full text you might as well specify the field to
+search within:
+
+```console
+$ esctl search -i foo* message=thai  | jq
+{
+  "id": "1779447242",
+  "score": 2.3842,
+  "index": "foo2",
+  "source": {
+    "message": "australian thai",
+    "title": "curry in a hurry"
+  }
+}
+```
+
+Of course you can search for multiple fields (or multiple terms in
+full text search). By default search terms are applied using logical
+AND, which you can change with the option `--or`.
+
+You can also change the sorting (`--sort-by`) and the time range
+(`--timerange`).
+
+To further narrow down search results you can add filters, which must
+match literally:
+
+```console
+$ esctl search -i foo* -F title=zeitbuchung message=pause | jq
+{
+  "id": "1779870750",
+  "score": 2.8426,
+  "index": "foo2",
+  "source": {
+    "message": "pause",
+    "time": "27.05.2026T10:33:45+0200",
+    "title": "zeitbuchung"
+  }
+}
+```
+
+To check which field mappings are available for an index:
+```console
+$ esctl index show foo2 
+INDEX-PROPERTY  VALUE                     
+name            foo2                      
+replicas        1                         
+shards          1                         
+created         2026-05-12 17:47:37       
+uuid            XmRtlh_JSreIzTB7jJNNJA    
+fields          id,message,time,title,user
+```
+
+Now, let's create a new index:
+
+```console
+$ esctl index create hyperdrive @timestamp:date message:keyword tag:text
+
+esctl index show hyperdrive 
+INDEX-PROPERTY  VALUE                 
+name            hyperdrive            
+replicas        1                     
+shards          1                     
+created         2026-06-24 10:16:23   
+uuid            gYfUj8TiR6aMB_BHmMYr3Q
+fields          @timestamp,message,tag
+```
+
+Once we have an index, we can insert documents into it (you'll need
+[gfn](https://codeberg.org/scip/gfn) for this):
+
+```console
+$ for name in $(gfn JapaneseNamesDiverse -n 20); do \
+     esctl doc add -i hyperdrive \
+     "{\"message\":\"$name\",\"tag\":\"loop\",\"@timestamp\":\"$(date
+     --iso-8601=second)\"}"; \
+     sleep 1; \
+  done
+3644770736267480972
+1249004675657072369
+5499556813583921546
+947619563748335783
+6804953496467561176
+1716813071323879201
+463762522269463473
+4674152788118344945
+7741776772191747414
+8531321287239151007
+3335734000533108391
+7020487792409206103
+4926995290680601261
+374509677635815298
+49895974689085266
+7603943644788310
+2102931816420108217
+696238814931581311
+2463257155346426021
+596556586001412147
+```
+
+Now, let's search them:
+
+```console
+$ esctl search -i hyperdrive -l 2 | jq
+{
+  "id": "2463257155346426021",
+  "score": 0.0000,
+  "index": "hyperdrive",
+  "source": {
+    "@timestamp": "2026-06-24T10:25:19+02:00",
+    "message": "inenen",
+    "tag": "loop"
+  }
+}
+{
+  "id": "596556586001412147",
+  "score": 0.0000,
+  "index": "hyperdrive",
+  "source": {
+    "@timestamp": "2026-06-24T10:25:20+02:00",
+    "message": "ominuhen",
+    "tag": "loop"
+  }
+}
+```
+
+Please note, that `esctl` is still in its early stages and things are
+changing heavily every now and then. New commands are being added
+constantly as well.
+
+### Command tree:
+
+```console
+api                   - api access and documentation
+  list                - list index of API calls
+  show                - show an API doc
+  repl                - interactive API repl
+ccr                   - manage cross cluster replication
+  status              - cross cluster replication status (yaml config with 2 clusters required)
+  pause               - pause shard allocation
+  resume              - resume shard allocation
+  follower            - manage ccr follower indices
+    show              - show ccr follower index details
+    add               - add ccr follower index
+    delete            - delete ccr follower index
+    unfollow          - unfollow ccr follower index
+    pause             - pause ccr index to follow
+    resume            - resume ccr index to follow
+    renew             - renew ccr follower index
+  info                - show ccr remote info
+cluster               - manage cluster[s]
+  status              - show cluster status
+  switch              - set current elasticsearch cluster
+  list                - list configured clusters
+  settings            - cluster settings management
+    list              - show cluster settings
+    set               - set|update cluster settings
+datastream            - manage data streams
+  list                - list indicies
+  show                - show details about an data stream
+  create              - create a new data stream
+  delete              - delete a data stream
+  rollover            - roll over a data stream
+doc                   - manage documents
+  add                 - add JSON document index
+  show                - show a JSON document
+  delete              - delete JSON document[s] from index[es]
+ilm                   - manage index lifecycle
+  retry               - retry applying an ILM profile to an index
+  status              - get the current index lifecycle management status
+  list                - list index lifecycle policies
+  show                - show details about an index lifecycle policy
+  create              - create a index lifecycle policy
+  forecast            - calculate index phase movements
+    list              - list index rollover config
+    show              - show rollover forecast over all indices
+index                 - manage indicies
+  list                - list indicies
+  show                - show details about an index
+  create              - create a new index
+  modify              - modify anindex
+  delete              - delete an index
+  close               - close an index
+  allocation          - explain index allocation
+  fields              - show info about field capabilities
+  ilm                 - show ilm status
+  alias               - manage index aliases
+    create            - create an index alias
+    list              - list index aliases
+    delete            - delete an index alias
+    rollover          - roll over an index alias
+  template            - manage index templates
+    list              - list index templates
+    show              - show details about an index template
+    create            - create a new index template
+    modify            - modify a new index template
+    delete            - delete an index template
+node                  - manage nodes
+  list                - list nodes
+  show                - show details about a node
+role                  - manage roles
+  list                - list roles
+  show                - show details about a role
+  diff                - show differences between roles and CSV baseline
+search                - search within an index
+shard                 - manage shards
+  list                - list shards
+  show                - show details about a shard
+snapshot              - manage snapshots
+  list                - list snapshots
+  show                - show details about a snapshot
+task                  - manage tasks
+  list                - list tasks
+  cancel              - cancel running task
+version               - show esctl version information
+debug                 - developer only
+help-jsonpath         - show jsonpath help
+completion            - Output shell completion script for bash, zsh, fish, or Powershell
+  pwsh                - Output pwsh completion script
+  bash                - Output bash completion script
+  zsh                 - Output zsh completion script
+  fish                - Output fish completion script
 ```
 
 # Development

cmd/ilm.go

@@ -37,6 +37,8 @@ func Ilm(conf *cfg.Config) *cli.Command {
 			IlmList(conf),
 			IlmShow(conf),
 			IlmCreate(conf),
+			IlmForecast(conf),
+			IlmExplain(conf),
 		},
 	}
 }
@@ -53,6 +55,23 @@ func IlmRetry(conf *cfg.Config) *cli.Command {
 	}
 }
 
+func IlmExplain(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "explain",
+		Usage:     "explain ilm condition of an index",
+		UsageText: "explain <index>",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.IlmExplain(conf, index)
+		},
+	}
+}
+
 func IlmStatus(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:  "status",
@@ -99,66 +118,6 @@ func IlmShow(conf *cfg.Config) *cli.Command {
 	}
 }
 
-/*
- *
-{
-  "policy": {
-    "phases": {
-      "hot": {
-        "min_age": "0ms",
-        "actions": {
-          "rollover": {
-            "max_primary_shard_size": "50gb",
-            "max_age": "1d",
-            "max_docs": 100000000
-          },
-          "set_priority": {
-            "priority": 100
-          }
-        }
-      },
-      "warm": {
-        "min_age": "7d",
-        "actions": {
-          "migrate": {},
-          "shrink": {
-            "number_of_shards": 1
-          },
-          "forcemerge": {
-            "max_num_segments": 1
-          },
-          "set_priority": {
-            "priority": 50
-          }
-        }
-      },
-      "cold": {
-        "min_age": "30d",
-        "actions": {
-          "migrate": {},
-          "searchable_snapshot": {
-            "snapshot_repository": "s3-logs-archive",
-            "force_merge_index": true
-          },
-          "set_priority": {
-            "priority": 0
-          }
-        }
-      },
-      "delete": {
-        "min_age": "90d",
-        "actions": {
-          "delete": {
-            "delete_searchable_snapshot": true
-          }
-        }
-      }
-    }
-  }
-}
-
-*/
-
 func IlmCreate(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:      "create",
@@ -185,7 +144,7 @@ func IlmCreate(conf *cfg.Config) *cli.Command {
 				Usage:       "hot phase: rollover after",
 				Destination: &conf.Ilm.HotRolloverMaxAge,
 			},
-			&cli.Int64Flag{
+			&cli.StringFlag{
 				Name:        "hot-rollover-max-primary-shard-size",
 				Usage:       "hot phase: max primary shard size",
 				Destination: &conf.Ilm.HotRolloverMaxPrimaryShardSize,
@@ -251,6 +210,11 @@ func IlmCreate(conf *cfg.Config) *cli.Command {
 				Usage:       "frozen phase: min age",
 				Destination: &conf.Ilm.FrozenMinAge,
 			},
+			&cli.StringFlag{
+				Name:        "frozen-searchable-snapshot-repo",
+				Usage:       "frozen phase: searchable snapshot repo",
+				Destination: &conf.Ilm.FrozenSearchableSnapshotRepo,
+			},
 
 			// delete
 			&cli.StringFlag{

cmd/ilm_forecast.go

@@ -0,0 +1,139 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package cmd
+
+import (
+	"context"
+	"errors"
+	"slices"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/es"
+
+	"github.com/urfave/cli/v3"
+)
+
+func IlmForecast(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "forecast",
+		Usage: "calculate index phase movements",
+
+		Commands: []*cli.Command{
+			IlmForecastList(conf),
+			IlmForecastShow(conf),
+		},
+	}
+}
+
+const IlmForeCastListReference = `<duration> must be a string which consists one or more of these elements:
+d - days
+h - hours
+m - minutes
+s - seconds
+
+Examples:
+
+58d12h  - 58 days and 12 hours
+122h30m - 122 hours and 30 minutes
+
+Specs may be mixed:
+
+8h12d   - 12 days and 8 hours`
+
+func IlmForecastList(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:               "list",
+		Aliases:            []string{"ls"},
+		Usage:              "list index rollover config",
+		UsageText:          "list [options] [<filter>]",
+		CustomHelpTemplate: addReference(IlmForeCastListReference),
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "from-phase",
+				Usage:       "which ilm phase to forecast from",
+				Destination: &conf.Ilm.FromPhase,
+				Aliases:     []string{"f"},
+			},
+			&cli.StringFlag{
+				Name:        "within",
+				Usage:       "<duration> withing which to forecast",
+				Destination: &conf.Ilm.Within,
+				Aliases:     []string{"w"},
+			},
+			&cli.StringFlag{
+				Name:        "min-age",
+				Usage:       "show only indices older than <duration>",
+				Destination: &conf.Ilm.MinAge,
+				Aliases:     []string{"m"},
+			},
+			&cli.BoolFlag{
+				Name:        "verbose",
+				Usage:       "show ilm policy as well",
+				Destination: &conf.Verbose,
+				Aliases:     []string{"v"},
+			},
+			&cli.BoolFlag{
+				Name:        "hidden",
+				Usage:       "include hidden indicies",
+				Destination: &conf.Hidden,
+				Aliases:     []string{"H"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			valid := []string{"hot", "warm", "cold", "frozen"}
+			if !slices.Contains(valid, conf.Ilm.FromPhase) {
+				return errors.New("invalid from phase, allowed: hot, warm, cold, frozen")
+			}
+
+			return es.IlmForecastList(conf, cmd.Args().Get(0))
+		},
+	}
+}
+
+func IlmForecastShow(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:    "show",
+		Aliases: []string{"sh"},
+		Usage:   "show rollover forecast over all indices",
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "from-phase",
+				Usage:       "which ilm phase to forecast from",
+				Destination: &conf.Ilm.FromPhase,
+				Aliases:     []string{"f"},
+			},
+			&cli.StringFlag{
+				Name:        "within",
+				Usage:       "duration withing which to forecast",
+				Destination: &conf.Ilm.Within,
+				Aliases:     []string{"w"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			valid := []string{"hot", "warm", "cold", "frozen"}
+			if !slices.Contains(valid, conf.Ilm.FromPhase) {
+				return errors.New("invalid from phase, allowed: hot, warm, cold, frozen")
+			}
+
+			return es.IlmForecastShow(conf)
+		},
+	}
+}

cmd/index.go

@@ -36,11 +36,11 @@ func Index(conf *cfg.Config) *cli.Command {
 		Commands: []*cli.Command{
 			IndexList(conf),
 			IndexShow(conf),
-			IndexCreate(conf),
+			IndexCreate(conf, false),
+			IndexCreate(conf, true),
 			IndexDelete(conf),
 			IndexClose(conf),
 			IndexAllocation(conf),
-			IndexModify(conf),
 			IndexFields(conf),
 			IndexIlm(conf),
 
@@ -70,6 +70,12 @@ func IndexList(conf *cfg.Config) *cli.Command {
 				Destination: &conf.Partials,
 				Aliases:     []string{"p"},
 			},
+			&cli.BoolFlag{
+				Name:        "hidden",
+				Usage:       "include hidden indicies",
+				Destination: &conf.Hidden,
+				Aliases:     []string{"H"},
+			},
 			&cli.BoolFlag{
 				Name:        "reds",
 				Usage:       "include only red failed indicies",
@@ -143,12 +149,20 @@ func IndexShow(conf *cfg.Config) *cli.Command {
 	}
 }
 
-func IndexCreate(conf *cfg.Config) *cli.Command {
+func IndexCreate(conf *cfg.Config, modify bool) *cli.Command {
+	name := "create"
+	usage := "create a new index"
+
+	if modify {
+		name = "modify"
+		usage = "modify anindex"
+	}
+
 	return &cli.Command{
-		Name:    "create",
+		Name:    name,
 		Aliases: []string{"+"},
-		Usage:   "create a new index",
-		UsageText: `create <name> <fieldmapping:type>...
+		Usage:   usage,
+		UsageText: name + ` <name> <fieldmapping:type>...
 Valid field mapping types: integer, text, date, keyword`,
 
 		Flags: []cli.Flag{
@@ -171,6 +185,12 @@ Valid field mapping types: integer, text, date, keyword`,
 				Aliases:     []string{"r"},
 				Value:       1,
 			},
+			&cli.StringFlag{
+				Name:        "ilm-policy",
+				Usage:       "ilm policy to apply",
+				Destination: &conf.Policy,
+				Aliases:     []string{"p"},
+			},
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -229,37 +249,6 @@ func IndexClose(conf *cfg.Config) *cli.Command {
 	}
 }
 
-func IndexModify(conf *cfg.Config) *cli.Command {
-	return &cli.Command{
-		Name:      "modify",
-		Usage:     "modify an index",
-		UsageText: "modify <index[,index,...]|_all>",
-
-		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
-		},
-
-		Flags: []cli.Flag{
-			&cli.IntFlag{
-				Name:        "replicas",
-				Usage:       "number of replicas",
-				Destination: &conf.Replicas,
-				Aliases:     []string{"r"},
-				Value:       1,
-			},
-		},
-
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			index := cmd.Args().Get(0)
-			if index == "" {
-				return errors.New("no index specified")
-			}
-
-			return es.IndexModify(conf, index)
-		},
-	}
-}
-
 func IndexFields(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:      "fields",

cmd/index_template.go

@@ -169,6 +169,12 @@ https://www.elastic.co/docs/reference/elasticsearch/index-settings
 				Destination: &conf.Aliases,
 				Aliases:     []string{"A"},
 			},
+			&cli.StringFlag{
+				Name:        "ilm-policy",
+				Usage:       "ilm policy to apply",
+				Destination: &conf.Policy,
+				Aliases:     []string{"p"},
+			},
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {

pkg/cfg/config.go

@@ -28,7 +28,7 @@ import (
 )
 
 const (
-	Version string = `v0.0.21`
+	Version string = `v0.0.22`
 )
 
 var (
@@ -51,6 +51,7 @@ type Config struct {
 	Failed, Partials bool   // index: flags
 	Shards, Replicas int    // index create+allocation: -s -r
 	Wait             bool   // index create: -w
+	Policy           string // index create: -p
 	Primary          bool   // index allocation: -p
 	Searchable       bool   // index fields: -s
 	Aggretable       bool   // index fields: -a

pkg/cfg/ilm.go

@@ -21,7 +21,7 @@ type Ilm struct {
 
 	HotMinAge                      string
 	HotRolloverMaxAge              string
-	HotRolloverMaxPrimaryShardSize int64
+	HotRolloverMaxPrimaryShardSize string
 	HotRolloverMaxDocs             int64
 	HotReadonly                    bool
 
@@ -36,16 +36,19 @@ type Ilm struct {
 	ColdPriority               int
 
 	FrozenMinAge                 string
+	FrozenSearchableSnapshotRepo string
 
 	DeleteMinAge              string
 	DeleteSearchableSnapshots bool
+
+	MinAge, FromPhase, Within string // forecast
 }
 
 func (cfg *Ilm) HaveHot() bool {
 	return cfg.HotMinAge != "" ||
 		cfg.HotRolloverMaxAge != "" ||
 		cfg.HotRolloverMaxDocs > 0 ||
-		cfg.HotRolloverMaxPrimaryShardSize > 0 ||
+		cfg.HotRolloverMaxPrimaryShardSize != "" ||
 		cfg.HotReadonly
 }
 

pkg/es/cluster.go

@@ -35,28 +35,8 @@ import (
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
 )
 
-const (
-	ResponseHealth = iota
-	ResponseInfo
-	ResponseCcr
-	ResponseStats
-	ResponseIndices
-	ResponseTasks
-)
-
 type ClusterIndices map[string]map[string]*types.IndicesRecord
 
-type apiResponse struct {
-	error   error
-	info    *info.Response
-	health  *health.Response
-	ccr     *stats.Response
-	stats   *clusterstats.Response
-	indices *indices.Response
-	tasks   *tasks.Response
-	which   int
-}
-
 func ClusterList(conf *cfg.Config) error {
 	table := printer.NewTable(conf, 4, len(conf.Clusters))
 
@@ -123,14 +103,14 @@ func ClusterStatus(conf *cfg.Config) error {
 		wg := &sync.WaitGroup{}
 
 		wg.Add(gocount)
-		go getClusterData(es, wg, responses, "health")
-		go getClusterData(es, wg, responses, "info")
-		go getClusterData(es, wg, responses, "ccrstats")
-		go getClusterData(es, wg, responses, "indices")
-		go getClusterData(es, wg, responses, "tasks")
+		go getApiData(es, wg, responses, "health")
+		go getApiData(es, wg, responses, "info")
+		go getApiData(es, wg, responses, "ccrstats")
+		go getApiData(es, wg, responses, "indices")
+		go getApiData(es, wg, responses, "tasks")
 
 		if conf.Verbose {
-			go getClusterData(es, wg, responses, "stats")
+			go getApiData(es, wg, responses, "stats")
 		}
 
 		wg.Wait()

pkg/es/cluster_util.go

@@ -18,16 +18,13 @@ package es
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"regexp"
 	"strconv"
 	"strings"
-	"sync"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
-	"github.com/elastic/go-elasticsearch/v9"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cluster/health"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
 )
@@ -334,69 +331,6 @@ func splitArg(arg string) (string, string) {
 	}
 }
 
-func getClusterData(es *elasticsearch.TypedClient, wg *sync.WaitGroup, reschan chan apiResponse, which string) {
-	defer wg.Done()
-
-	ar := apiResponse{}
-	arerr := errors.New("")
-
-	switch which {
-	case "health":
-		res, err := es.Cluster.Health().
-			Do(context.Background())
-
-		ar.health = res
-		ar.which = ResponseHealth
-		arerr = err
-
-	case "info":
-		res, err := es.Info().
-			Do(context.Background())
-
-		ar.info = res
-		ar.which = ResponseInfo
-		arerr = err
-
-	case "ccrstats":
-		res, err := es.Ccr.Stats().
-			Do(context.Background())
-
-		ar.ccr = res
-		ar.which = ResponseCcr
-		arerr = err
-
-	case "stats":
-		res, err := es.Cluster.Stats().
-			Do(context.Background())
-
-		ar.stats = res
-		ar.which = ResponseStats
-		arerr = err
-
-	case "indices":
-		res, err := es.Cat.Indices().
-			Do(context.Background())
-
-		ar.indices = &res
-		ar.which = ResponseIndices
-		arerr = err
-
-	case "tasks":
-		res, err := es.Cat.Tasks().
-			Do(context.Background())
-
-		ar.tasks = &res
-		ar.which = ResponseTasks
-		arerr = err
-	}
-
-	if arerr != nil {
-		ar.error = fmt.Errorf("failed to get cluster health: %s", arerr)
-	}
-
-	reschan <- ar
-}
-
 // recursively traverse  the raw  settings hash and  build a  flat map
 // consisting of the translated path and its value.
 //

pkg/es/duration.go

@@ -0,0 +1,126 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"fmt"
+	"math"
+	"regexp"
+	"strconv"
+	"time"
+)
+
+var (
+	matchDuration = regexp.MustCompile(`(\d+)([dhms])`)
+)
+
+type esDuration struct {
+	days, hours, minutes, seconds int
+}
+
+/*
+We could use time.ParseDuration(), but this doesn't support days.
+
+We  could also  use github.com/xhit/go-str2duration/v2,  which does
+the job,  but it's  just another dependency,  just for  this little
+gem. And  we don't need a  time.Time value. And int  is good enough
+for duration comparison.
+
+Convert a  duration into  an integer.  Valid  time units  are "s", "m", "h" and "d".
+
+	via https://codeberg.org/scip/tablizer/src/branch/main/lib/sort.go#L113
+*/
+func parseDuration(duration string) time.Duration {
+
+	seconds := 0
+
+	for _, match := range matchDuration.FindAllStringSubmatch(duration, -1) {
+		if len(match) == 3 {
+			durationvalue, _ := strconv.Atoi(match[1])
+
+			switch match[2][0] {
+			case 'd':
+				seconds += durationvalue * 86400
+			case 'h':
+				seconds += durationvalue * 3600
+			case 'm':
+				seconds += durationvalue * 60
+			case 's':
+				seconds += durationvalue
+			}
+		}
+	}
+
+	return time.Duration(seconds) * time.Second
+}
+
+// pretty much the same as above, but return a struct filled with int duration values
+func extractDuration(duration string) esDuration {
+	esd := esDuration{}
+
+	for _, match := range matchDuration.FindAllStringSubmatch(duration, -1) {
+		if len(match) == 3 {
+			durationvalue, _ := strconv.Atoi(match[1])
+
+			switch match[2][0] {
+			case 'd':
+				esd.days = durationvalue
+			case 'h':
+				esd.hours = durationvalue
+			case 'm':
+				esd.minutes = durationvalue
+			case 's':
+				esd.seconds = durationvalue
+			}
+		}
+	}
+
+	return esd
+}
+
+// convert a duration like 156h6m15.095s-6d/12h/6m => 6d:12h:6m
+func formatDuration(val time.Duration) string {
+	esd := extractDuration(val.String())
+
+	daysF := float64(esd.hours) / 24.0
+	days := math.Floor(daysF)
+	hoursLeft := (daysF - days) * 24
+
+	switch {
+	case val.Minutes() < 1:
+		return fmt.Sprintf("%ds", int64(esd.seconds))
+
+	case val.Hours() < 1:
+		return fmt.Sprintf("%dm", int64(esd.minutes))
+
+	case val.Hours() < 24:
+		if esd.minutes == 0 {
+			return fmt.Sprintf("%dh", esd.hours)
+		}
+		return fmt.Sprintf("%dh:%dm", esd.hours, int64(esd.minutes))
+
+	default:
+		if esd.minutes == 0 && hoursLeft == 0 {
+			return fmt.Sprintf("%dd", int64(days))
+		}
+		return fmt.Sprintf("%dd:%dh:%dm",
+			int64(days),
+			int64(hoursLeft),
+			esd.minutes,
+		)
+	}
+}

pkg/es/ilm.go

@@ -18,6 +18,7 @@ package es
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -26,6 +27,7 @@ import (
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/alecthomas/repr"
+	"github.com/charmbracelet/lipgloss"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/putlifecycle"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
@@ -183,18 +185,38 @@ func IlmExplain(conf *cfg.Config, index string) error {
 	table := printer.NewTable(conf, 2, 0)
 	table.Addheaders("ilm status field", "value")
 
+	info := ""
+	err = json.Unmarshal(ilm.StepInfo["reason"], &info)
+	if err != nil {
+		return fmt.Errorf("failed to unmarshal step info: %w", err)
+	}
+
 	table.Entries = [][]string{
 		{"index", ilm.Index},
 		{"ilm policy", *ilm.Policy},
 		{"action", *ilm.Action},
-		{"step", *ilm.Step},
 		{"age", fmt.Sprintf("%s", ilm.Age)},
 		{"managed", fmt.Sprintf("%t", ilm.Managed)},
 		{"phase", *ilm.Phase},
 		{"phase execution", ilmPhaseString(ilm.PhaseExecution.PhaseDefinition, false)},
+		{"step", *ilm.Step},
+		{"failed step", *ilm.FailedStep},
+		{"failed step retry count", fmt.Sprintf("%d", ilm.FailedStepRetryCount)},
 	}
 
-	return table.Print()
+	if err := table.Print(); err != nil {
+		return err
+	}
+
+	if info != "" {
+		var bold = lipgloss.NewStyle().Bold(true)
+
+		fmt.Printf("\n%s:\n%s\n",
+			bold.Render("Step Reason"),
+			info)
+	}
+
+	return nil
 }
 
 func IlmCreate(conf *cfg.Config, policyname string) error {
@@ -223,7 +245,7 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 			haveroll = true
 		}
 
-		if cfg.HotRolloverMaxPrimaryShardSize != 0 {
+		if cfg.HotRolloverMaxPrimaryShardSize != "" {
 			rollover.MaxPrimaryShardSize = &cfg.HotRolloverMaxPrimaryShardSize
 		}
 
@@ -259,16 +281,50 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 		phases.PhasesCaster().Warm = &warm
 	}
 
+	if cfg.HaveCold() {
+		cold := types.Phase{}
+		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
+
+		if cfg.ColdForceMerge != 0 {
+			actions.IlmActionsCaster().Forcemerge = &types.ForceMergeAction{MaxNumSegments: cfg.ColdForceMerge}
+		}
+
+		if cfg.ColdMinAge != "" {
+			cold.MinAge = cfg.ColdMinAge
+		}
+
+		if cfg.ColdPriority != 0 {
+			actions.IlmActionsCaster().SetPriority = &types.SetPriorityAction{Priority: &cfg.ColdPriority}
+		}
+
+		if cfg.ColdSearchableSnapshotRepo != "" {
+			actions.IlmActionsCaster().SearchableSnapshot =
+				&types.SearchableSnapshotAction{SnapshotRepository: cfg.ColdSearchableSnapshotRepo}
+		}
+
+		cold.Actions = actions.IlmActionsCaster()
+		phases.PhasesCaster().Cold = &cold
+	}
+
 	if cfg.HaveFrozen() {
-		froze := phases.PhasesCaster().Frozen
+		froze := types.Phase{}
+		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
 
 		if cfg.FrozenMinAge != "" {
 			froze.MinAge = cfg.FrozenMinAge
 		}
+
+		if cfg.FrozenSearchableSnapshotRepo != "" {
+			actions.IlmActionsCaster().SearchableSnapshot =
+				&types.SearchableSnapshotAction{SnapshotRepository: cfg.FrozenSearchableSnapshotRepo}
+		}
+
+		froze.Actions = actions.IlmActionsCaster()
+		phases.PhasesCaster().Frozen = &froze
 	}
 
 	if cfg.HaveDelete() {
-		del := phases.PhasesCaster().Delete
+		del := types.Phase{}
 		delete := types.DeleteAction{}
 		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
 
@@ -282,7 +338,7 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 
 		actions.IlmActionsCaster().Delete = &delete
 		del.Actions = actions.IlmActionsCaster()
-		phases.PhasesCaster().Delete = del
+		phases.PhasesCaster().Delete = &del
 	}
 
 	put := &putlifecycle.Request{}

pkg/es/ilm_forecast.go

@@ -0,0 +1,391 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
+	"github.com/dustin/go-humanize"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/indices"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/explainlifecycle"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/getlifecycle"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+)
+
+var (
+	IlmPhaseOrder = []string{"hot", "warm", "cold", "frozen", "delete"}
+)
+
+type NextPhase struct {
+	minage      time.Duration
+	minsize     int64
+	phase       string
+	previousHot bool
+}
+
+type PhaseData struct {
+	index                   string
+	policy                  string
+	size                    int64
+	age                     time.Duration
+	minage                  time.Duration
+	minsize                 int64
+	currentPhase, nextPhase string
+}
+
+/*
+	ilm stages:
+
+types.Lifecycle{
+
+		  Policy: types.IlmPolicy{
+		    Phases: types.Phases{
+		      Hot: &types.Phase{
+		        Actions: &types.IlmActions{
+		          Rollover: &types.RolloverAction{
+		            MaxAge: "7d",
+		            MaxPrimaryShardSize: "25gb",
+		          },
+		        },
+		        MinAge: "0ms",
+		      },
+		      Warm: &types.Phase{
+		        MinAge: "0d",
+		      },
+			  Frozen: &types.Phase{
+		        MinAge: "14d",
+			  },
+			  Delete: &types.Phase{
+		        MinAge: "60d",
+		      },
+		    },
+		  },
+		  }
+
+	   hot for 7 days or 25Gig, then Rollover => warm 14 days => frozen 60 days => delete
+*/
+
+func IlmForecastList(conf *cfg.Config, filter string) error {
+	phaseData, err := getIlmPhaseData(conf)
+	if err != nil {
+		return err
+	}
+
+	flt := regexp.MustCompile(filter)
+
+	minage := time.Duration(0)
+	if conf.Ilm.MinAge != "" {
+		minage = parseDuration(conf.Ilm.MinAge)
+	}
+
+	headers := []string{"index", "current size", "current age",
+		"virtual age", "min age", "min size", "current phase", "next phase"}
+	if conf.Verbose {
+		headers = append(headers, "ilm policy")
+	}
+
+	table := printer.NewTable(conf, len(headers), 0)
+	table.Addheaders(headers...)
+
+	for _, phase := range phaseData {
+		if filter != "" && !flt.MatchString(phase.index) {
+			continue
+		}
+
+		if conf.Ilm.MinAge != "" && phase.age < minage {
+			continue
+		}
+
+		virtualAge := virtualAge(&phase)
+
+		row := []string{
+			phase.index,
+			humanize.Bytes(uint64(phase.size)),
+			formatDuration(phase.age),
+			formatDuration(virtualAge),
+			formatDuration(phase.minage),
+			humanize.Bytes(uint64(phase.minsize)),
+			phase.currentPhase,
+			phase.nextPhase,
+		}
+
+		if conf.Verbose {
+			row = append(row, phase.policy)
+		}
+
+		table.AddRow(row...)
+	}
+
+	table.Sort()
+	return table.Print()
+}
+
+// Loop  over   all  current  index   phases  of  the   current  phase
+// (conf.Ilm.FromPhase). Calculate virtualAge  if phase.minsize >0. If
+// the actual age is smaller than the virtual age, use this as a base,
+// otherwise use virtual  age. Then look if the  rollover would happen
+// within the phase.minage window  (conf.Ilm.Within + current age) and
+// add the size.
+func IlmForecastShow(conf *cfg.Config) error {
+	phaseData, err := getIlmPhaseData(conf)
+	if err != nil {
+		return err
+	}
+
+	within := parseDuration(conf.Ilm.Within)
+	var toBeFreed int64 = 0
+
+	for _, phase := range phaseData {
+		age := virtualAge(&phase)
+
+		if age < phase.age {
+			age = phase.age
+		}
+
+		if age+within >= phase.minage {
+			toBeFreed += phase.size
+		}
+	}
+
+	fmt.Printf("%s bytes of data in %s phase will be rolled within %s to the next phase\n",
+		humanize.Bytes(uint64(toBeFreed)),
+		conf.Ilm.FromPhase,
+		within)
+
+	return nil
+}
+
+func virtualAge(phase *PhaseData) time.Duration {
+	if phase.minsize == 0 {
+		return time.Duration(0)
+	}
+
+	return phase.minage * time.Duration(100*phase.size/phase.minsize) / 100
+}
+
+// Retrieve all index, ilm-explain and ilm-policies in parallel
+func getIlmPhaseData(conf *cfg.Config) ([]PhaseData, error) {
+	responses := make(chan apiResponse, 3)
+	wg := &sync.WaitGroup{}
+	wg.Add(3)
+
+	go getApiData(conf.DefaultCluster.ES(), wg, responses, "indicesbytes")
+	go getApiData(conf.DefaultCluster.ES(), wg, responses, "explain")
+	go getApiData(conf.DefaultCluster.ES(), wg, responses, "policies")
+
+	wg.Wait()
+
+	var ilmdetails *explainlifecycle.Response
+	var indicesres *indices.Response
+	var ilmpolicies getlifecycle.Response
+
+	for i := 0; i < 3; i++ {
+		r := <-responses
+
+		if r.error != nil {
+			return nil, r.error
+		}
+
+		switch r.which {
+		case ResponseExplain:
+			ilmdetails = r.explainlifecycle
+		case ResponseIndices:
+			indicesres = r.indicesbytes
+		case ResponseLifecycle:
+			ilmpolicies = *r.lifecycle
+		}
+	}
+
+	list := []PhaseData{}
+
+	indices := make(map[string]types.IndicesRecord)
+	for _, index := range *indicesres {
+		indices[*index.Index] = index
+	}
+
+	for indexName, explain := range ilmdetails.Indices {
+		if !conf.Hidden && strings.HasPrefix(indexName, ".") {
+			continue
+		}
+
+		// avoid types.LifecycleExplainUnmanaged casting error
+		switch explain.(type) {
+		case *types.LifecycleExplainManaged:
+		default:
+			continue
+		}
+
+		explain := explain.(*types.LifecycleExplainManaged)
+
+		if explain.Phase == nil {
+			continue
+		}
+
+		phase := *explain.Phase
+
+		if phase != conf.Ilm.FromPhase {
+			continue
+		}
+
+		size, err := strconv.ParseInt(*indices[indexName].DatasetSize, 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert index.DatasetSize to int: %w", err)
+		}
+
+		age := time.Duration(*explain.AgeInMillis * int64(time.Millisecond))
+
+		policy := ilmpolicies[*explain.Policy].Policy
+
+		nextPhase := findNextPhase(policy, phase)
+		if nextPhase == nil {
+			continue
+		}
+
+		list = append(list, PhaseData{
+			index:        indexName,
+			policy:       *explain.Policy,
+			size:         size,
+			age:          age,
+			minage:       nextPhase.minage,
+			minsize:      nextPhase.minsize,
+			currentPhase: conf.Ilm.FromPhase,
+			nextPhase:    nextPhase.phase,
+		})
+	}
+
+	return list, nil
+}
+
+func registerPhases(policy types.IlmPolicy, currentPhase string) (map[string]*types.Phase, int) {
+	// register phases configured in the policy
+	phases := map[string]*types.Phase{
+		"hot":    nil,
+		"warm":   nil,
+		"cold":   nil,
+		"frozen": nil,
+		"delete": nil,
+	}
+
+	// looking for a defined previous phase
+	start := 0
+
+	// register phases
+	for idx, phase := range IlmPhaseOrder {
+		switch phase {
+		case "hot":
+			if policy.Phases.Hot != nil {
+				phases[phase] = policy.Phases.Hot
+			}
+
+		case "warm":
+			if policy.Phases.Warm != nil {
+				phases[phase] = policy.Phases.Warm
+			}
+
+		case "cold":
+			if policy.Phases.Cold != nil {
+				phases[phase] = policy.Phases.Cold
+			}
+
+		case "frozen":
+			if policy.Phases.Frozen != nil {
+				phases[phase] = policy.Phases.Frozen
+			}
+
+		case "delete":
+			if policy.Phases.Delete != nil {
+				phases[phase] = policy.Phases.Delete
+			}
+		}
+
+		if phase == currentPhase {
+			start = idx
+		}
+	}
+
+	return phases, start
+}
+
+func findNextPhase(policy types.IlmPolicy, currentPhase string) *NextPhase {
+	// phase list to determine which comes next
+	phases, start := registerPhases(policy, currentPhase)
+
+	nextPhase := &NextPhase{}
+
+	// finally determine which phase comes next
+	// exception: hot, where we look for rollover rules
+	for idx, phase := range IlmPhaseOrder {
+		if idx < start {
+			continue
+		}
+
+		if phase == "hot" {
+			// if we're starting here, do not look for the next phase
+			maxage := parseDuration(phases[phase].Actions.Rollover.MaxAge.(string))
+
+			var maxsize int64 = 0
+
+			switch val := phases[phase].Actions.Rollover.MaxPrimaryShardSize.(type) {
+			case int64:
+				maxsize = val
+			case string:
+				size, err := humanize.ParseBytes(val)
+				if err != nil {
+					panic(err)
+				}
+
+				maxsize = int64(size)
+			}
+
+			nextPhase.minage = maxage
+			nextPhase.minsize = maxsize
+			nextPhase.previousHot = true
+
+			continue
+		}
+
+		if phase == currentPhase {
+			continue // use the next one
+		}
+
+		if phases[phase] == nil {
+			continue // skip it, since empty
+		}
+
+		nextPhase.phase = phase
+
+		if nextPhase.previousHot {
+			return nextPhase
+		}
+
+		minage := parseDuration(phases[phase].MinAge.(string))
+
+		nextPhase.minage = minage
+		nextPhase.minsize = 0
+
+		return nextPhase
+	}
+
+	return nil
+}

pkg/es/index.go

@@ -53,11 +53,16 @@ func IndexNames(conf *cfg.Config) ([]string, error) {
 func filterIndices(conf *cfg.Config, list indices.Response) indices.Response {
 	// apply partials filter first
 	selectedlist := indices.Response{}
+
 	for _, index := range list {
 		if !conf.Partials && strings.HasPrefix(*index.Index, "partial-") {
 			continue
 		}
 
+		if !conf.Hidden && strings.HasPrefix(*index.Index, ".") {
+			continue
+		}
+
 		if strings.HasPrefix(*index.Index, ".ds-") {
 			// ignore data stream backing indicies
 			continue
@@ -131,6 +136,8 @@ func IndexShow(conf *cfg.Config, indexpattern string) error {
 		return fmt.Errorf("failed to get index: %s", esErrorString(err))
 	}
 
+	slog.Debug("index show", "index", res)
+
 	for name, index := range res {
 		fields := make([]string, len(index.Mappings.Properties))
 		idx := 0
@@ -139,7 +146,7 @@ func IndexShow(conf *cfg.Config, indexpattern string) error {
 			idx++
 		}
 
-		table := printer.NewTable(conf, 2, 5)
+		table := printer.NewTable(conf, 2, 7)
 		table.Addheaders("index property", "value")
 
 		ts, err := strconv.ParseInt(index.Settings.Index.CreationDate.(string), 10, 64)
@@ -155,9 +162,17 @@ func IndexShow(conf *cfg.Config, indexpattern string) error {
 			{"shards", *index.Settings.Index.NumberOfShards},
 			{"created", created.Format("2006-01-02 15:04:05")},
 			{"uuid", *index.Settings.Index.Uuid},
+			{"version", *index.Settings.Index.Version.Created},
 			{"fields", strings.Join(fields, ",")},
 		}
 
+		if index.Settings.Index.Lifecycle != nil {
+			table.Entries = append(table.Entries, [][]string{
+				{"ilm policy", *index.Settings.Index.Lifecycle.Name},
+				{"ilm rollover alias", *index.Settings.Index.Lifecycle.RolloverAlias},
+			}...)
+		}
+
 		if err := table.Print(); err != nil {
 			return err
 		}
@@ -178,10 +193,10 @@ func IndexCreate(conf *cfg.Config, index string, mappings []string) error {
 	}
 
 	if conf.Shards > 0 {
-		settings = settings.NumberOfShards(strconv.Itoa(conf.Shards))
+		settings.NumberOfShards(strconv.Itoa(conf.Shards))
 	}
 	if conf.Replicas > 0 {
-		settings = settings.NumberOfReplicas(strconv.Itoa(conf.Replicas))
+		settings.NumberOfReplicas(strconv.Itoa(conf.Replicas))
 	}
 
 	if len(mappings) > 0 {
@@ -208,6 +223,13 @@ func IndexCreate(conf *cfg.Config, index string, mappings []string) error {
 		create.Mappings(maps)
 	}
 
+	if conf.Policy != "" {
+		settings.Lifecycle(
+			esdsl.NewIndexSettingsLifecycle().
+				Name(conf.Policy).
+				RolloverAlias(index))
+	}
+
 	_, err := create.Settings(settings).
 		Do(context.Background())
 
@@ -281,6 +303,7 @@ func IndexAllocation(conf *cfg.Config, index string) error {
 	return nil
 }
 
+/*
 func IndexModify(conf *cfg.Config, index string) error {
 	settings := esdsl.NewIndexSettings().NumberOfReplicas(strconv.Itoa(conf.Replicas))
 
@@ -294,6 +317,7 @@ func IndexModify(conf *cfg.Config, index string) error {
 
 	return nil
 }
+*/
 
 func IndexFields(conf *cfg.Config, index string) error {
 	res, err := conf.DefaultCluster.ES().FieldCaps().

pkg/es/index_template.go

@@ -157,11 +157,17 @@ func IndexTemplateCreate(conf *cfg.Config, name string, mappings []string) error
 	create := conf.DefaultCluster.ES().Indices.PutIndexTemplate(name)
 
 	if conf.Shards > 0 {
-		settings = settings.NumberOfShards(strconv.Itoa(conf.Shards))
+		settings.NumberOfShards(strconv.Itoa(conf.Shards))
 	}
 
 	if conf.Replicas > 0 {
-		settings = settings.NumberOfReplicas(strconv.Itoa(conf.Replicas))
+		settings.NumberOfReplicas(strconv.Itoa(conf.Replicas))
+	}
+
+	if conf.Policy != "" {
+		settings.Lifecycle(
+			esdsl.NewIndexSettingsLifecycle().
+				Name(conf.Policy))
 	}
 
 	if conf.Stream {
@@ -284,6 +290,10 @@ func IndexTemplateModify(conf *cfg.Config, name string, mappings []string) error
 		*settings.Mode = conf.Mode
 	}
 
+	if conf.Policy != "" {
+		settings.Lifecycle.Name = &conf.Policy
+	}
+
 	if len(mappings) > 0 {
 		typemaps, err := modMappings(mappings)
 		if err != nil {

pkg/es/parallel.go

@@ -0,0 +1,152 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"github.com/elastic/go-elasticsearch/v9"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/indices"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/tasks"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ccr/stats"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/cluster/health"
+	clusterstats "github.com/elastic/go-elasticsearch/v9/typedapi/cluster/stats"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/core/info"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/explainlifecycle"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/getlifecycle"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/bytes"
+)
+
+const (
+	ResponseHealth = iota
+	ResponseInfo
+	ResponseCcr
+	ResponseStats
+	ResponseIndices
+	ResponseTasks
+	ResponseExplain
+	ResponseLifecycle
+)
+
+type apiResponse struct {
+	error            error
+	info             *info.Response
+	health           *health.Response
+	ccr              *stats.Response
+	stats            *clusterstats.Response
+	indices          *indices.Response
+	indicesbytes     *indices.Response
+	tasks            *tasks.Response
+	lifecycle        *getlifecycle.Response
+	explainlifecycle *explainlifecycle.Response
+	which            int
+}
+
+func getApiData(es *elasticsearch.TypedClient, wg *sync.WaitGroup,
+	reschan chan apiResponse, which string) {
+	defer wg.Done()
+
+	ar := apiResponse{}
+	arerr := errors.New("")
+
+	switch which {
+	case "health":
+		res, err := es.Cluster.Health().
+			Do(context.Background())
+
+		ar.health = res
+		ar.which = ResponseHealth
+		arerr = err
+
+	case "info":
+		res, err := es.Info().
+			Do(context.Background())
+
+		ar.info = res
+		ar.which = ResponseInfo
+		arerr = err
+
+	case "ccrstats":
+		res, err := es.Ccr.Stats().
+			Do(context.Background())
+
+		ar.ccr = res
+		ar.which = ResponseCcr
+		arerr = err
+
+	case "stats":
+		res, err := es.Cluster.Stats().
+			Do(context.Background())
+
+		ar.stats = res
+		ar.which = ResponseStats
+		arerr = err
+
+	case "indices":
+		res, err := es.Cat.Indices().
+			Do(context.Background())
+
+		ar.indices = &res
+		ar.which = ResponseIndices
+		arerr = err
+
+	case "indicesbytes":
+		res, err := es.Cat.
+			Indices().
+			Bytes(bytes.Bytes{Name: "b"}).
+			Do(context.Background())
+
+		ar.indicesbytes = &res
+		ar.which = ResponseIndices
+		arerr = err
+
+	case "tasks":
+		res, err := es.Cat.Tasks().
+			Do(context.Background())
+
+		ar.tasks = &res
+		ar.which = ResponseTasks
+		arerr = err
+
+	case "explain":
+		res, err := es.Ilm.
+			ExplainLifecycle("_all").
+			Do(context.Background())
+
+		ar.explainlifecycle = res
+		ar.which = ResponseExplain
+		arerr = err
+
+	case "policies":
+		res, err := es.Ilm.
+			GetLifecycle().
+			Do(context.Background())
+
+		ar.lifecycle = &res
+		ar.which = ResponseLifecycle
+		arerr = err
+	}
+
+	if arerr != nil {
+		ar.error = fmt.Errorf("failed to get data from API: %s", arerr)
+	}
+
+	reschan <- ar
+}