Filebeat indices get grouped by ILM

my Problem is that Filebeat indices are not named like the default should be (on a daily basis), but the naming seems to be affected by the used Index Lifecycle Policy. So when they should stay in hot phase for 6 days and then should be deleted (which should be much easier to do, like setting a single number in Kibana), then all indices in this 6-day period are named like filebeat-7.3.2-2019.11.29-000009, which looks more like a rollup index name. The name seems to be given on the first day of a six-day period and then changes. If the hot phase would end after 30 days than only a single index per month would be created. The older data also ends with 000009. I have no idea where this comes from as in a previous test the index names displayed the correct date and without the 000009 suffix. Of interest in the settings (as inspected with Kibana) may be

"provided_name": "<filebeat-7.3.2-{now/d}-000009>"

although i nowhere set it like this. The index is then deleted on the 7th day, which also includes the newest data in the index which is only 2 days old at that point in time.

Hope someone can help, thanks!

Welcome! The index pattern you're seeing does look like a result of ILM triggering a rollover... have you configured a rollover policy? (You can check in Kibana). It's hard to say more without seeing the configuration, but if you share your Filebeat configuration and index / rollover details we could probably help further.

Thanks for your reply. In the filebeat.yml no specific index pattern is set, so I assume the default "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}" is used. As for a lifecycle policy I use

"policy": {
    "phases": {
        "hot": {
            "min_age": "0ms",
            "actions": {
                "rollover": {
                    "max_age": "6d",
                    "max_size": "50gb"
        "delete": {
            "min_age": "1d",
            "actions": {
                "delete": {}

The Rollup-Job is currently stopped but index pattern was set to filebeat-7.3.2-*. Perhaps the rollup index name filebeat-7.3.2 was the problem...