Elasticsearch custom ILM

Elastic Stack Elasticsearch
3

I think you set me on the right track. I ended up finding this article regarding apm manual index lifecycle management

https://www.elastic.co/guide/en/apm/server/current/manual-ilm-setup.html

I did load the default beats template originally so it has order of 1. I ended up adding another template specifically for my custom index

PUT _template/winlogbeat-7.3.0-miles-ilm
{
"order": 2,
"index_patterns": ["winlogbeat-7.3.0-miles*"],
"settings": {
"index.lifecycle.rollover_alias": "winlogbeat-7.3.0-miles",
"index.lifecycle.name": "hot-warm-delete-30days"
}
}

I then manually added the index with the alias association (don't believe I need date in index for this to work)

PUT winlogbeat-7.3.0-miles-000001
{
"aliases": {
"winlogbeat-7.3.0-miles": {
"is_write_index": true
}
}
}

So now logstash elasticsearch output is still using the ilm_rollover_alias with metadata to form the value winlogbeat-7.3.0-miles for this beat and is writing to the newly created index.

  "settings": {
    "index": {
      "lifecycle": {
        "name": "hot-warm-delete-30days",
        "rollover_alias": "winlogbeat-7.3.0-miles"
      },
      "routing": {
        "allocation": {
          "require": {
            "data": "hot"
          }
        }
      },
      "mapping": {
        "total_fields": {
          "limit": "10000"
        }
      },
      "refresh_interval": "5s",
      "number_of_shards": "5",
      "provided_name": "winlogbeat-7.3.0-miles-000001"

Seems like this will work but I feel like i'm missing something that should make this a bit easier and more dynamic than the manual method