Enable ILM for different filebeat indices

Elastic Stack Elasticsearch
1

Hi,
I have two different indices in my filebeat. one for cisco module (cisco-beats-0001) and one for the rest of the logs(default filebeat index).
so far:

  • I've disabled ILM in filebeat
  • I've created an index lifecycle policy (rollover policy)
  • I've added my policy to my cisco index template

I'm not sure what to do now. according to the docs I have to bootstrap the first index. should I create the first index myself or wait for the filebeat to create the next one (cisco-beats-0002)?

2

You can wait till the first index is automatically created, then just make sure it has the appropriate ILM aliases attached to it.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.