Rollover and Lifecycle Policy

I am looking to implement a policy and I had a few questions/concerns about how things should flow.
Starting state: “Hot”
Hot State:

  • Rollover at min_size 40gb.
  • Transition:
    • if min_size 40gb, go to “warm” ← At this point I assume if this gets hit then the rollover will have always been done. Is there a chance that during action phase, it is under 40, then at transition it is over 40? or does it only grab the size for evaluation once at the start?
    • if past (cron statement) go to “hot rollover”

Hot rollover state

  • rollover at min_doc count 1
  • Transition
    • if min_doc_count 1 go to “warm” ← kind of the same question as above


  • set to read only

or should I swap to something like
Hot state:

  • no actions
  • Transitions:
    • if min_size 40gb go to “rolling”
    • if past cron expression go to “rolling”

Rolling state:

  • rollover if min_doc_count 1
  • Transition to “Warm” if min_doc_count 1

… etc

I am basically looking for a clean way to cut the data into weeks/months using rollover. I realize this might lead to a few logs leaking in (since the ism process is run on a delay), but IMO it is better than an index “index-2021.04-0000X” being created at 11:30pm on April 30th, getting all of the first few weeks of Mays logs until it rolls over later in the month.