# Elastic ILM Filebeat

**URL:** <https://discuss.elastic.co/t/elastic-ilm-filebeat/345716>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 25, 2023, 9:46am UTC](https://discuss.elastic.co/t/elastic-ilm-filebeat/345716 "2023-10-25T09:46:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![lehu](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@lehu](https://discuss.elastic.co/u/lehu)\
**Post date:** [October 25, 2023, 9:46am UTC](https://discuss.elastic.co/t/elastic-ilm-filebeat/345716/1 "2023-10-25T09:46:02Z")

</div>

Hi,

so I created a working lifecycle policy and I want it to apply it to the indices that are daily created by filebeat. But my filebeat configuration uses setup.template.name and setup.template.pattern and I dont want to change it to avoid the tons of mappings. But I cant define a policy for filebeat because ` If index lifecycle management is enabled (which is typically the default), setup.template.name and setup.template.pattern are ignored.`. Is there any way to solve this problem?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 25, 2023, 9:40pm UTC](https://discuss.elastic.co/t/elastic-ilm-filebeat/345716/2 "2023-10-25T21:40:40Z")

</div>

Hi @lehu

What Version? Very Important.

Share your filebeat.yml.

You should be able to add the ILM policy to the template and then use the write alias as the output in filebeat.

Set the ILM policy to rollover daily, and you should be good.

---

<div class="post-metadata">

**Author:** ![lehu](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@lehu](https://discuss.elastic.co/u/lehu)\
**Post date:** [November 6, 2023, 9:51am UTC](https://discuss.elastic.co/t/elastic-ilm-filebeat/345716/3 "2023-11-06T09:51:28Z")

</div>

Version: 8.10.4

This is basically how my filebeat.yml looks like:

```auto
filebeat.inputs:

- type: filestream

  id: my-filestream-id

  enabled: true

  paths:
    - my_path

  parsers:
    - ndjson:
        target: ""
        overwrite_keys: true
        add_error_key: true

setup.template.settings:
  index.number_of_shards: 1
  
setup.template:
  name: "test"
  pattern: "test-*"
  enabled: false

cloud.id: my_cloud_id

output.elasticsearch:
  api_key: my_api_key
 
  index: "test-%{[agent.version]}-%{+yyyy.MM.dd}"

logging.level: debug
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0640

```

Thanks for the answer

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 6, 2023, 3:41pm UTC](https://discuss.elastic.co/t/elastic-ilm-filebeat/345716/4 "2023-11-06T15:41:26Z")

</div>

Take a look at this.

> **[Change the index name | Filebeat Reference \[8.10\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/change-index-name.html)**

This shows the configuration.

Run setup etc.

If you want daily backing indices, then you will set the rollover to 1d in the ILM policy, not on the index name i.e. don't use `-%{+yyyy.MM.dd}` ... In General, you do not use the Daily Naming and ILM together... its one or the other... with ILM rollover set to 1 day you effectively get Daily indices... that will look like

`.ds-filebeat-8.10.4-2023.10.15-000001`

---

<div class="post-metadata">

**Author:** ![lehu](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@lehu](https://discuss.elastic.co/u/lehu)\
**Post date:** [November 7, 2023, 5:37am UTC](https://discuss.elastic.co/t/elastic-ilm-filebeat/345716/5 "2023-11-07T05:37:40Z")

</div>

Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2023, 7:37am UTC](https://discuss.elastic.co/t/elastic-ilm-filebeat/345716/6 "2023-12-05T07:37:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.