Enable ILM for different filebeat indices

I have two different indices in my filebeat. one for cisco module (cisco-beats-0001) and one for the rest of the logs(default filebeat index).
so far:

  • I've disabled ILM in filebeat
  • I've created an index lifecycle policy (rollover policy)
  • I've added my policy to my cisco index template

I'm not sure what to do now. according to the docs I have to bootstrap the first index. should I create the first index myself or wait for the filebeat to create the next one (cisco-beats-0002)?

You can wait till the first index is automatically created, then just make sure it has the appropriate ILM aliases attached to it.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.