Editing a managed policy can break Kibana

[DaddyYusk (Jonathan VINCENT)]

Hi,
After a successful Fleet Server and Elastic Agent deployment, I wanted to tweak the ILM called "logs" and "metrics" which are both "Managed".

But when trying to do so, I encounter this well known warning :

So after some research, I've found this great post, where @leandrojmp suggest to follow this tutorial.

This tutorial is great and perfectly clear, but wait... what if I want to apply the 90-days-default ILM policy to ALL the logs-* and metrics-* datasets (and not for each one)?

Because this could be quite overwhelming and mostly if you have multiple namespaces...

Thanks a lot for your help.
Regards.

[leandrojmp (Leandro Pereira)]

@DaddyYusk

This tutorial is great and perfectly clear, but wait... what if I want to apply the 90-days-default ILM policy to ALL the logs-* and metrics-* datasets (and not for each one)?

Not sure you can do that, the easiest way is to edit the built-in policies.

You will receive that warning, but you still can edit, this is what I did to add a delete phase to the logs-* lifecycle policy.

Until elastic fixes this and makes it easier to customize lifecycle policies, pipelines and mappings, there is not much else you can do.

[DaddyYusk (Jonathan VINCENT)]

Once again many thanks @leandrojmp for your answer!

Have a great day!
Regards.