Deprecated index lifecycle policies

Elastic Stack Elastic Agent
1

I’m using the elastic agent to load pod logs from kubernetes:

    - id: container-log-${kubernetes.pod.name}-${kubernetes.container.id}
      type: filestream
      use_output: default
      meta:
        package:
          name: kubernetes
          version: 1.80.2
      data_stream:
        namespace: default
      streams:
      - id: container-log-${kubernetes.pod.name}-${kubernetes.container.id}
        data_stream:
          dataset: kubernetes.container
          type: logs
        prospector.scanner.symlinks: true
        paths: ["/var/log/containers/*${kubernetes.container.id}.log"]

The above input creates a new data stream: logs-kubernetes.container-default which is based on the “logs” index lifecycle policy. Why is this policy deprecated? Should I create a new policy?

elastic-ilm
elastic-ilm451×591 54.5 KB

elastic-ilm-logs
elastic-ilm-logs976×311 41.4 KB

2

If I'm not wrong this changed on 8.13, but I could not find the reason for the changes.

There are some new built-in policies ending with @lifecycl now.

But since this is from an Elastic Agent integration I don't think you need to make any change, Elastic needs to change it on their side to use one of the new lifecycle policies.

You can always change it to one of the built-in policies or to a custom one, for example, all my data from integrations uses a custom lifecycle policies configured in the @custom component template.

1 Like
3

thank you for the clarification