# By Date Indexes when using Elastic Ingest

**URL:** https://discuss.elastic.co/t/by-date-indexes-when-using-elastic-ingest/242994
**Category:** Elasticsearch
**Created:** [July 29, 2020, 4:47am UTC](https://discuss.elastic.co/t/by-date-indexes-when-using-elastic-ingest/242994 "2020-07-29T04:47:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![tbernhardson](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tbernhardson](https://discuss.elastic.co/u/tbernhardson)
#### Post date: [July 29, 2020, 4:47am UTC](https://discuss.elastic.co/t/by-date-indexes-when-using-elastic-ingest/242994/1 "2020-07-29T04:47:13Z")

</div>

When using Logstash it's easy to tell the system to create indices by day (also then making it easy to delete old data). I've tried to figure out how to do the same thing when sending the beats data directly to Elasticsearch instead of through Logstash and havn't had any luck.  
Can someone point me to documentation on how to do this?  
I.E. Currently when using Elastic Ingest the indices are named auditbeat-7.6.2-2020.04.19-000001 (for example) with the date appearing to be when Elastic was started. I would like to create one index for each day, for all the different beats (auditbeat, metricbeat, filebeat, etc).

Thanks  
Tim B

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 29, 2020, 4:59am UTC](https://discuss.elastic.co/t/by-date-indexes-when-using-elastic-ingest/242994/2 "2020-07-29T04:59:18Z")

</div>

Beats use [ILM](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-start.html) by default. The idea being you don't need to worry about daily indices, as it will manage the rollover for you.

The indices will rollover every 30 days, or when the size hits 50GB using ILM.

---

<div class="post-metadata">

### Author: ![tbernhardson](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tbernhardson](https://discuss.elastic.co/u/tbernhardson)
#### Post date: [July 29, 2020, 3:29pm UTC](https://discuss.elastic.co/t/by-date-indexes-when-using-elastic-ingest/242994/3 "2020-07-29T15:29:21Z")

</div>

Ok, then I need to look into why ILM isn't working, because I have 4+ months of data taking up roughly a TB of data..

Thanks  
Tim B

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 26, 2020, 3:29pm UTC](https://discuss.elastic.co/t/by-date-indexes-when-using-elastic-ingest/242994/4 "2020-08-26T15:29:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
