Inspired by this topic:
I went into kibana -> Index Management -> [index name] -> Manage index
There was an option to Remove lifecycle policy
- do that
Unlike the above post I didn't need to close the index first, it worked while it was open
After that the view and option changes to Add lifecycle policy
- do that
It allows you to select the updated lifecycle policy and gives a warning that I ignored:
Index has no aliases
Policy filebeat is configured for rollover, but index .ds-filebeat-8.16.0-2024.11.19-000001 does not have an alias, which is required for rollover.
(it seems this is an incorrect warning because a datastream doesn't need/have an alias)
After a few minutes elasticsearch had gone through the lifecycle actions and rolled the index over. Woohoo!