Trying to get my head around ILM.
My beats are ingested via logstash. When updating beats i point them at elasticsearch to add the new index etc.
My logstash index pattern is along the files of filebeat-version-source-tenantid
I have created with the bootstrap for now with:
The multi-tenancy is the main issue, do I have to do this for every index I will be generating?