Assigning lifecycle policy to diffent indices

Elastic Stack Elasticsearch
1

Hi all,

in our installation filebeat is writing indices with different name depending on fields of the message which are sent to elasticsearch. For all these indices the same index template is used.

Is it possible to assign different lifecycle policies to the different indices ?

AFAIK the assigning of lifecycle policy to an index is done via the index template ? But that means all indices using the same template have the same lifecycle policy assigned. That's not what I want.

Thnx for any hints !

Best regards,
Detlef

2

You will need to have one template for every index pattern that you want to use a different lifecycle policy.

You can have one template will all your mappings, settings etc, and one template per index pattern with just the lifecycle policy, but with a higher priority, so when the template merges it will use this lifecycle policy.