Can ILM policy be created on an existing set of indexes?

[Ong (OCY)]

Currently, i am have a FluentD daemon writing app logs to Elasticsearch. The index names have the naming convention "logstash-(date)" e.g. logstash-2023-08-15.

Is it possible to create an ILM policy that applies to these existing indexes and any new ones created?

I read from the ES documentation that the index name has to end with a rolling number hence i am not sure if ILM can be applied to indexes with the naming convention above.

[leandrojmp (Leandro Pereira)]

@Ong

Is it possible to create an ILM policy that applies to these existing indexes and any new ones created?

It really depends on what you want the ILM policy to do.

If you have daily indices and you want to move those indices to a different data tier, e.g. from hot nodes to warm nodes, or just delete the indices after a specific amount of days, than you just need to create the ILM policy with those actions set this policy in your current indices and change your template so this policy is applied to now indices.

But if you want the ILM to automatically rollover your indices after some days or when it reach some specific size, then you will need to change the way you index your data.

@Ong

I read from the ES documentation that the index name has to end with a rolling number

This only applies when you want to use the rollover option of the ILM policy, if you want to keep creating daily indices you turn-off the rollover and the ILM policy will work for the other actions (move indices and delete).