my Problem is that Filebeat indices are not named like the default should be (on a daily basis), but the naming seems to be affected by the used Index Lifecycle Policy. So when they should stay in hot phase for 6 days and then should be deleted (which should be much easier to do, like setting a single number in Kibana), then all indices in this 6-day period are named like filebeat-7.3.2-2019.11.29-000009, which looks more like a rollup index name. The name seems to be given on the first day of a six-day period and then changes. If the hot phase would end after 30 days than only a single index per month would be created. The older data also ends with 000009. I have no idea where this comes from as in a previous test the index names displayed the correct date and without the 000009 suffix. Of interest in the settings (as inspected with Kibana) may be
although i nowhere set it like this. The index is then deleted on the 7th day, which also includes the newest data in the index which is only 2 days old at that point in time.
Hope someone can help, thanks!