@Felix_Roessel @rcowart @warkolm
I did a lot of tests with Filebeat NetFlow Module and ElastiFlow. Unfortunately, Filebeat netflow module is not good yet. Even using disks NVMe, more CPU and Memory the result of a query (24h) is terrible, 2 - 4 minutes. When I did a similar query with ElastiFlow it took 1 or 2 seconds.
I am gonna use ElastiFlow free edition.
@rcowart please give me directions to deploy my ILM policy (everything automatically as mentioned before) - send me a direct message.