Editing a managed policy can break Kibana

Elastic Stack Elasticsearch
1

Hi,
After a successful Fleet Server and Elastic Agent deployment, I wanted to tweak the ILM called "logs" and "metrics" which are both "Managed".

But when trying to do so, I encounter this well known warning :
image

So after some research, I've found this great post, where @leandrojmp suggest to follow this tutorial.

This tutorial is great and perfectly clear, but wait... what if I want to apply the 90-days-default ILM policy to ALL the logs-* and metrics-* datasets (and not for each one)?

Because this could be quite overwhelming and mostly if you have multiple namespaces...

Thanks a lot for your help.
Regards.

2

Not sure you can do that, the easiest way is to edit the built-in policies.

You will receive that warning, but you still can edit, this is what I did to add a delete phase to the logs-* lifecycle policy.

Until elastic fixes this and makes it easier to customize lifecycle policies, pipelines and mappings, there is not much else you can do.

1 Like
3

Once again many thanks @leandrojmp for your answer!

Have a great day!
Regards.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.