Hi everyone,
I’m using Elasticsearch (8.15.1) for logging in my server environment, and Fleet to distribute agents across the servers.
The indices created are currently using the logs
index lifecycle policy, which according to Elasticsearch is now deprecated.
What’s the recommended way to change the ILM policy for indices created through Fleet and Elastic Agent?
From what I’ve seen, there are basically two options:
-
Create an index template with a higher priority to override the existing ILM setting.
-
“Fork” the integration package, meaning:
-
Download the Exchange integration package
-
Update its
manifest.yml
and component templates so thatindex.lifecycle.name: ilm-logs-exchange
-
Install it as a custom package in Fleet
-
That way, Fleet would handle everything with the new policy.
-
Are there any other approaches I should consider?
Thanks in advance!