# Filebeat Index with Module in Name -\> Alias and ILM

**URL:** https://discuss.elastic.co/t/filebeat-index-with-module-in-name-alias-and-ilm/315346
**Category:** Beats
**Tags:** ilm-index-lifecycle-management, filebeat
**Created:** [September 28, 2022, 9:50am UTC](https://discuss.elastic.co/t/filebeat-index-with-module-in-name-alias-and-ilm/315346 "2022-09-28T09:50:56Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![BoKu](https://avatars.discourse-cdn.com/v4/letter/b/bc8723/32.png) [@BoKu](https://discuss.elastic.co/u/BoKu)
#### Post date: [September 28, 2022, 9:50am UTC](https://discuss.elastic.co/t/filebeat-index-with-module-in-name-alias-and-ilm/315346/1 "2022-09-28T09:50:56Z")

</div>

Hello there,

i do have the following situation. I run Filebeat on an dedicated server for the panw-Module, with a dedicated Port. Our Paloalto Firewall is shipping the logs via syslog to the filebeat-server.  
If i run filebeat on that server with the default configuration, the indexname, aliases and ILM is working fine. But when i add the following to the "output.elasticsearch":

```auto
indices:
    - index: "filebeat-%{[event.module]}-%{+yyyy.MM.dd}"
      when.has_fields: ['event.module']

```

I get an index called: "filebeat-panw-2022.09.28, without an alias an ergo i am unable to assign an ILM-Policy

What do i have to do to setup a dedicated index for the paloalto firewall with a dedicated ILM-Policy?

Thanks in advance!

Greets  
Boris

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 26, 2022, 9:51am UTC](https://discuss.elastic.co/t/filebeat-index-with-module-in-name-alias-and-ilm/315346/2 "2022-10-26T09:51:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.