What is the hot-warm-cold architecture in Elasticsearch and how do you implement it for cost-effective log storage?

# Node configuration for each tier
# Hot node
node.roles: [data_hot, data_content]
path.data: /mnt/nvme/elasticsearch

# Warm node
node.roles: [data_warm]
path.data: /mnt/hdd/elasticsearch

# ILM policy with hot-warm-cold
PUT _ilm/policy/logs-tiered
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": { "max_size": "50gb", "max_age": "1d" },
          "set_priority": { "priority": 100 }
        }
      },
      "warm": {
        "min_age": "7d",
        "actions": {
          "shrink": { "number_of_shards": 1 },
          "forcemerge": { "max_num_segments": 1 },
          "allocate": { "require": { "data": "warm" }},
          "set_priority": { "priority": 50 }
        }
      },
      "cold": {
        "min_age": "30d",
        "actions": {
          "searchable_snapshot": { "snapshot_repository": "s3-repo" }
        }
      },
      "delete": { "min_age": "90d", "actions": { "delete": {} }}
    }
  }
}