Dynamic index name with ILM

Elastic Stack Beats
1

Hi,

I currently have this setup which works fine:

---
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: filebeat
  namespace: elasticsearch
...
setup:
  ilm:
    enabled: false
  template:
    name: filebeat
    pattern: 'filebeat-*'
output.elasticsearch:
  index: "filebeat-%{[agent.version]}-%{[kubernetes.container.name]:default}-%{+yyyy.MM.dd}"

My problem is: I want to have different ILM depending on the container_name.

I basically want the container1 index to keep logs for 1 day and the rest (containerX) for 30 days. How can I achieve this? I didn't find this kind of use cases on the forum or in the docs.

Should it be all setup in the interface? I'm not even sure ILM supports it.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.