It seems each new filebeat version creates its own mapping template and ilm policy. i had to manually update ilm policy to add delete phase. but for each new version a new ilm policy is created with default sections (without delete phase) and then has to be updated manually. is there a more easier approach for this ?
Hi @Jathin 
I'm not an expert in ILM but when you usually apply a Policy to an index template which should look like filebeat-* so no matter which version you are using, it will cover indices starting with filebeat-*. Some extra info: https://www.elastic.co/guide/en/elasticsearch/reference/current/applying-policy-to-template.html
I hope this helps
But it seems filebeat create templates for each version and they map to a ilm policy with version in name and that ilm policy does not have delete phase.. also you can just have one policy per index.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.