Update event log ILM policy defaults (#64675)

* Initial work

* Update docs

* Add delete phase mention to docs

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

x-pack/plugins/event_log/README.md

@@ -274,10 +274,16 @@ PUT _ilm/policy/event_log_policy
       "hot": {                      
         "actions": {
           "rollover": {             
-            "max_size": "5GB",
+            "max_size": "50GB",
             "max_age": "30d"
           }
         }
+      },
+      "delete": {
+        "min_age": "90d",
+        "actions": {
+          "delete": {}
+        }
       }
     }
   }
@@ -285,10 +291,11 @@ PUT _ilm/policy/event_log_policy
 ```
 
 This means that ILM would "rollover" the current index, say
-`.kibana-event-log-000001` by creating a new index `.kibana-event-log-000002`,
+`.kibana-event-log-8.0.0-000001` by creating a new index `.kibana-event-log-8.0.0-000002`,
 which would "inherit" everything from the index template, and then ILM will
 set the write index of the the alias to the new index.  This would happen
-when the original index grew past 5 GB, or was created more than 30 days ago.
+when the original index grew past 50 GB, or was created more than 30 days ago.
+After rollover, the indices will be removed after 90 days to avoid disks to fill up.
 
 For more relevant information on ILM, see:
 [getting started with ILM doc][] and [write index alias behavior][]:

x-pack/plugins/event_log/server/es/documents.ts

@@ -31,12 +31,18 @@ export function getIlmPolicy() {
         hot: {
           actions: {
             rollover: {
-              max_size: '5GB',
+              max_size: '50GB',
               max_age: '30d',
               // max_docs: 1, // you know, for testing
             },
           },
         },
+        delete: {
+          min_age: '90d',
+          actions: {
+            delete: {},
+          },
+        },
       },
     },
   };