Custom index names with an ILM policy

[michielM (Michiel)]

Hi all, I am trying to setup my elk stack and beats in a way that I can have an ILM policy in combination with custom index names.

For example:
I want to have the index name filebeat-department-01/01/2000
and have it closed after 30 days and deleted after 44 days.

But when I create a custom index name like filebeat-department-01/01/2000
Indexes are getting created automatically every day. Which I do not want since it's much harder to manage.

Is there a way to create custom index names without having daily indexes?

[Mario_Castro]

Hi @michielM

Maybe you are lacking the ILM pattern? https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html Daily indices are the way to go so it seems like a conceptual problem from your side. If you have an fat index, you cannot close and delete part of it after X days. They way it works is by deleting full indexes. That's how you achieve to have only the last 30 days (last 30 indices)

[michielM (Michiel)]

Hi @Mario_Castro, thanks for the quick reply.

I thought that if I wanted to create my own index name, I can't use the ILM anymore?

What would be the right way to configure this? Above you can see the current config.

[Mario_Castro]

Check the parameter setup.ilm.pattern in the link above.

EDIT: You can use your own index name and in the image attached you have ILM disabled too.

[michielM (Michiel)]

Okay I see,

So do I just put setup.ilm.enabled: auto
and setup.ilm.pattern: "{now/M{yyyy.MM}}-000001"

Or am I missing something else here?