[BIG-IP ASM] Could not index event to Elasticsearch

Elastic Stack Logstash
8

See here how to customize ILM for a data stream...

Basically Clone the existing Policy and Edit to your liking and give it a name... like logs-custom

Add a custom template you can do through the UI or this is the whole request in Kibana - Dev Tools

PUT _component_template/logs@custom
{
  "template": {
    "settings": {
      "index": {
        "lifecycle": {
          "name": "logs-custom"
        }
      }
    }
  }
}

If you are going to use agents... you must use data streams

If you want to you indices for some other data fine...

BUT you will then have a mixed approach and you you will still need to define rollover and ILM etc for your non-datastream data