How to apply new ILM policy to existing datastream index

Elastic Stack Elasticsearch
1

I found several posts about this topic but none gave the actual answer, so thought I would post:

I had an existing index on a datastream (filebeat) which had the default 30d ILM policy assigned, but was growing large. I had edited the ILM policy in kibana, but the old index didn't get the new policy updates. Solution below.

2

Inspired by this topic:

I went into kibana -> Index Management -> [index name] -> Manage index

There was an option to Remove lifecycle policy - do that

Unlike the above post I didn't need to close the index first, it worked while it was open

After that the view and option changes to Add lifecycle policy - do that
It allows you to select the updated lifecycle policy and gives a warning that I ignored:

Index has no aliases

Policy filebeat is configured for rollover, but index .ds-filebeat-8.16.0-2024.11.19-000001 does not have an alias, which is required for rollover.

(it seems this is an incorrect warning because a datastream doesn't need/have an alias)

After a few minutes elasticsearch had gone through the lifecycle actions and rolled the index over. Woohoo!