Disable automatic creation of daily indexes

[michielM (Michiel)]

Hey all,

I recently created custom index names because I needed spaces for customers, and each customer needed an index to link to the space. So that's what I did. I have these indexes now.

• auditbeat-customer1-01/01/2000

• filebeat--customer1-01/01/2000

• metricbeat-customer1-01/01/2000

• auditbeat-customer2-01/01/2000

• filebeat--customer2-01/01/2000

• metricbeat-customer2-01/01/2000

Previously, my indexes would have stayed open until they reached 50GB.
Now a new index is created every day for each beat. So I am getting new indexes every day, which I rather don't. I'd like to keep the same index until it reaches 50GB.
But I have no idea on how to do this. Any ideas?

Below is the config of my beats.yml
#=============================== Index management =============================
setup.ilm.enabled: false

output.elasticsearch.index: "auditbeat-customer1-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "auditbeat-customer1"
setup.template.pattern: "auditbeat-customer1-"
setup.dashboards.index: "auditbeat-customer1-"

[warkolm (Mark Walkom)]

@michielM

I'd like to keep the same index until it reaches 50GB.

You need to use ILM to do this. You can specify custom index names though.

[michielM (Michiel)]

How do I do this? Thanks for the quick reply!

[warkolm (Mark Walkom)]

https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html, and the other beats have similar pages

[michielM (Michiel)]

So, does it mean that if I set ilm.enabled to auto, I can use custom index names and use my policy?