I am using the Suricata filebeat module to send Suricata logs directly to ES. I am using all the default filebeat indexes.
I want to change the default index and index patterns names to be suricata instead of filebeat. I have to disable ILM?
Is there any possibility to configure a new ILM and configure that new index to use it?