Creating ILM

Elastic Stack Elasticsearch
1

I want to create an ILM rule that would that would apply to all indices ( I only have auditbeat-* and filebeat-*).

In ILM, it seems like there's no option to give it an indice, but rather it wants index template.

How do I create an index template that would include both my indices? I only need it so I could apply ILM to both my indices. Thanks ahead!

2

Per your reddit thread, you may want to create a single policy, and apply it to both templates.

1 Like
3

Thanks for the response!

I don't think I have an index template for either of them. Should I just go to Stack management > Index management > Index template > Create template > Under index pattern name it filebeat* and just click next on all the optional fields? (and then do it all again with `auditbeat*)

Thanks ahead!

4

Yeah that'd be the best approach.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.