# How can I add a ilm policy to an existing datastream index **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management, datastreams\ **Created:** [October 18, 2022, 8:09pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931 "2022-10-18T20:09:21Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [October 18, 2022, 8:09pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931/1 "2022-10-18T20:09:21Z")
Some how I have got an index (currently being written) in a data stream which does not have an ilm setting and therefore is not getting rolled over. It is unclear to me what I should do. When I tried to close the index I got dire warnings about closing system indexes. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 19, 2022, 3:09am UTC](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931/2 "2022-10-19T03:09:47Z")
What is the name of the datastream? ---
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [October 23, 2022, 2:02am UTC](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931/3 "2022-10-23T02:02:30Z")
datastream name "Sec-events" ![Screen Shot 2022-10-23 at 2.49.19 PM](https://us1.discourse-cdn.com/elastic/original/3X/9/d/9d7cb2e2e6a8eb2766e5646b37d62f66dff35408.png) current index summary: ![Screen Shot 2022-10-23 at 2.50.37 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8cad6f2316201e2e43363dfad6cfb48921d00d23.png) initial index summary: ![Screen Shot 2022-10-23 at 2.54.14 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e287df8434b7e417c56adf65fa7c147b138a3cd4.png) ---
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [October 24, 2022, 8:07pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931/4 "2022-10-24T20:07:05Z")
Over the weekend the index rolled over -- not a clue what was going on. ---
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [November 4, 2022, 11:12pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931/5 "2022-11-04T23:12:37Z")
actually I lie! I just found that it has not rolled over. I must have been looking at something else. Sigh... So I decided to try closing the index to see if this would force ES to open a new one and was not too surprised to find that it didn't. I then realised that closing the index also kills reading so I went into kibana to try to reopen the index (list indexes -\> select index -\> click manage) and was surprised that there was now an option to add an ILM policy to the index which I did. The ILM section now appeared and showed `action : rollover`. Woohoo! But no new indexes appeared and my write to the data stream are still failing. So I `open ` in kibana to reopen the index and viola! new index and I no more 500 errors in the ingestion processes! So the answer to the original question "Some how I have got an index (currently being written) in a data stream which does not have an ilm setting and therefore is not getting rolled over" is: 1/. close the index 2/ assign the ilm policy to it 3/ reopen the index caveat: **you will loose any data being written to the index while is closed** If you can pause ingestion without data loss you should. (I could not easily as the data coming in via syslog) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 2, 2022, 11:12pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931/6 "2022-12-02T23:12:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.