# Elastic Indexes and Data Streams **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [April 30, 2025, 2:28pm UTC](https://discuss.elastic.co/t/elastic-indexes-and-data-streams/377674 "2025-04-30T14:28:44Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![h0nus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/h0nus/32/142879_2.png) [@h0nus](https://discuss.elastic.co/u/h0nus)\ **Post date:** [April 30, 2025, 2:28pm UTC](https://discuss.elastic.co/t/elastic-indexes-and-data-streams/377674/1 "2025-04-30T14:28:44Z")
Hello everyone, I was wondering how should I make my policy for Elastic to clean the space up on a 200GB limited space VM. I studied deeply the config of Index Policies and I've set my custom ones for my needs. Since I'm just using the trial of ES 9 (for the Defend feature, which rocks), but in like 5 days (with Windows, Syslog, Defend and Auditd Logs) it gets almost full. This is my current Index Policy (hoping it makes actually sense): ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d8ba2d5874bb7b213d0180017d5f57e4f6d0381c.png) My point was: If the index is 1 day older or exceeds 10gb do rollup. Then push the current to warm and make it read only when it's 2 day older. FInally delete it when it's 3 days old. But my actual goal is just to clean up space when we pass like 2days, since I'm just doing a trial and I get a lot of events (all of the, not just Defend one) Surely my config is wrong and I assumed so, so i forced on the data stream this config: ```auto Effective data retention 5 days // For now 5 just to see if this worked. ``` Do you guys have any tips or advice for my needs? Let me know if you need any other info! Probably I just mis-read and mis-understood the docs, so blame it on me 🙂 ---
**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Post date:** [May 19, 2025, 6:08am UTC](https://discuss.elastic.co/t/elastic-indexes-and-data-streams/377674/2 "2025-05-19T06:08:38Z")
Hello, Could you please share what is the count of HOT Nodes, WARM nodes , their disk size? along with this what is the avg daily size of data which is received ? This will help to provide better suggestion of the ILM policy configuration we should configure to keep the disk space below 85% of 200GB Thanks!! ---
**Author:** ![h0nus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/h0nus/32/142879_2.png) [@h0nus](https://discuss.elastic.co/u/h0nus)\ **Post date:** [May 20, 2025, 4:16pm UTC](https://discuss.elastic.co/t/elastic-indexes-and-data-streams/377674/3 "2025-05-20T16:16:51Z")
Hello there,I think the actual issue on my setup was that I added the custom policy to indexes / streams after they were created and populated, hence not working. In the new setup, I tried to add integrations, modify them before getting used / populated and after a week i see my rule works. At least I think this was the culprit or maybe a broken install. But now is resolved, sorry for the waste of time and thanks for the patience! ❤