# Configure ILM in filebeat
**URL:** https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954
**Category:** Beats
**Tags:** filebeat
**Created:** [October 22, 2020, 7:52am UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954 "2020-10-22T07:52:02Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@gizem](https://discuss.elastic.co/u/gizem)
#### Post date: [October 22, 2020, 7:52am UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954/1 "2020-10-22T07:52:02Z")
Hello,
I was using 7.0.1 version of filebeat before, and my index configuration line this:
setup.template.name: "index"
setup.template.pattern: "index-\*"
output.elasticsearch:
index: "index-%{[fields.type]:other}-%{+yyyy.MM.dd}"
I upgraded the filebeat to version 7.9.2 and I want to use ILM. I tried this configuration and it does not work:
setup.ilm.enabled: auto
setup.ilm.rollover\_alias: "index-%{[fields.type]:other}"
setup.ilm.pattern: "{now/d}-000001"
How can I achieve this? I want to use "fields.type" in my index.
Regards,
Gizem
---
### Author:  [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [October 22, 2020, 10:53am UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954/2 "2020-10-22T10:53:28Z")
Hi,
This does not work as described in [this](https://github.com/elastic/beats/issues/12233#issuecomment-577248992) comment:
> ILM and templates are global settings. Beats do not manage templates + policies for multiple indices and have no access to fields in events. In fact templates and ILM policies are setup before the first event is available.
The solution would be to manually bootstrap the indexes as described [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html):
- create ILM policy
- create index template for index-other and all other possible values
```auto
PUT _index_template/index-other
{
"index_patterns": ["index-other-*"],
"template": {
"settings": {
"number_of_shards": 1,
"number_of_replicas": 1,
"index.lifecycle.name": "my_policy",
"index.lifecycle.rollover_alias": "index-other"
}
}
}
```
- bootstrap initial indexes
```auto
PUT index-other-000001
{
"aliases": {
"index-other": {
"is_write_index": true
}
}
}
```
Then, instead of configuring ILM in the Beats you just have to configure Beats to write to the created ILM alias:
```auto
output.elasticsearch:
index: "index-%{[fields.type]:other}"
```
Best regards
Wolfram
---
### Author:  [@gizem](https://discuss.elastic.co/u/gizem)
#### Post date: [October 22, 2020, 11:06am UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954/3 "2020-10-22T11:06:10Z")
Thank for reply @Wolfram_Haussig.
I want to ask another thing. I tried to use static rollover alias, and set a policy for it. But new index is not created. I am using ingest pipeline and not use logstash. Did it happen because of this?
---
### Author:  [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [October 22, 2020, 11:16am UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954/4 "2020-10-22T11:16:35Z")
Using a static rollover alias should work:
```auto
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "index"
setup.ilm.pattern: "{now/d}-000001"
```
Can you post the configuration you tried? Did you get any logs?
---
### Author:  [@gizem](https://discuss.elastic.co/u/gizem)
#### Post date: [October 22, 2020, 11:54am UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954/5 "2020-10-22T11:54:57Z")
My configuration in filebeat:
setup.ilm.enabled: auto
setup.ilm.rollover\_alias: "filebeat"
setup.ilm.pattern: "{now/d}-000001"
For trying I update the filebeat lifecycle policy maximum index size 20 KB. The other options are default.
My index: filebeat-2020.10.22-000001. It is keep loading data even if it exceeds 20 KB. Should new index is created like filebeat-2020.10.22-000002?
Should I stop/start something or delete the index?
---
### Author:  [@gizem](https://discuss.elastic.co/u/gizem)
#### Post date: [October 22, 2020, 12:43pm UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954/6 "2020-10-22T12:43:49Z")
When I stop the filebeat, new index is created. It is very intresting and I don't understand why.
And the old index storage size 871kb. I set the policy 20kb.
What is it about @Wolfram_Haussig?
---
### Author:  [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [October 22, 2020, 12:47pm UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954/7 "2020-10-22T12:47:08Z")
Hi,
I guess you are running into the effect that ElasticSearch does not poll often enough if the index meets the policy criteria. You can change that as described [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-settings.html) (Default is 10 minutes):
```auto
indices.lifecycle.poll_interval: 30s
```
---
### Author:  [@gizem](https://discuss.elastic.co/u/gizem)
#### Post date: [October 22, 2020, 1:16pm UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954/8 "2020-10-22T13:16:19Z")
> [@Wolfram\_Haussig](#):
>
> `indices.lifecycle.poll_interval: 30s`
This is the solution. Thank you very much @Wolfram_Haussig
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 19, 2020, 3:16pm UTC](https://discuss.elastic.co/t/configure-ilm-in-filebeat/252954/9 "2020-11-19T15:16:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.