# Filebeat module custom policy management

**URL:** <https://discuss.elastic.co/t/filebeat-module-custom-policy-management/234183>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 25, 2020, 4:51pm UTC](https://discuss.elastic.co/t/filebeat-module-custom-policy-management/234183 "2020-05-25T16:51:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Post date:** [May 25, 2020, 4:51pm UTC](https://discuss.elastic.co/t/filebeat-module-custom-policy-management/234183/1 "2020-05-25T16:51:15Z")

</div>

I want to apply custom ilm\_policy for every index that I create with filebeat.

I tried below approach

```
`#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["someip:9200"]
  username: "elastic"
  password: "somepassword"
  ssl.certificate_authorities: ["/etc/elasticsearch/certs/ca/ca.crt"]
  ssl.certificate: "/etc/elasticsearch/certs/filebeat/filebeat.crt"
  ssl.key: "/etc/elasticsearch/certs/filebeat/filebeat.key"
  # Protocol - either `http` (default) or `https`.
  protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  indices:
    - index: "filebeat-netflow-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "netflow"

    - index: "filebeat-cisco-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "cisco"

#================================= Migration ==================================

# This allows to enable 6.7 migration aliases
#migration.6_to_7.enabled: true
script.max_compilations_rate: 2000/5m
script.cache_max_size: 1000

setup.ilm.enabled: true
setup.ilm.rollover_alias: "filebeat-cisco"
setup.ilm.pattern: "{now/d}-rolled"
setup.ilm.check_exists: true
setup.ilm.policy_file: /etc/filebeat/ilm_policy_cisco.txt
setup.ilm.overwrite: true

setup.ilm.rollover_alias: "filebeat-netflow"
setup.ilm.pattern: "{now/d}-rolled"
setup.ilm.check_exists: true
setup.ilm.policy_file: /etc/filebeat/ilm_policy_netflow.txt
`

```

Policy in /etc/filebeat/ilm\_policy\_netflow.txt

```
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_age": "1d",
            "max_size": "200gb"
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "cold": {
        "min_age": "2d",
        "actions": {
          "set_priority": {
            "priority": 25
          }
        }
      },
      "delete": {
        "min_age": "3d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

```

This obviously only applies only the last configured value, not per index. One weird thing is that rolling occurs immediately as shown below.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bd7e38a0d9a007c5d8c7808861a297f9d2f2ff59.png)

How can I apply different policy file per index?  
Why the file is rolled immediately after being created?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2020, 4:51pm UTC](https://discuss.elastic.co/t/filebeat-module-custom-policy-management/234183/2 "2020-06-22T16:51:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.