in our installation filebeat is writing indices with different name depending on fields of the message which are sent to elasticsearch. For all these indices the same index template is used.
Is it possible to assign different lifecycle policies to the different indices ?
AFAIK the assigning of lifecycle policy to an index is done via the index template ? But that means all indices using the same template have the same lifecycle policy assigned. That's not what I want.
Thnx for any hints !