How to change the policy of an existing datastream

Elastic Stack Kibana
1

Hey all,

so current situation is that we set up logging for openshift into elastic, and it has taken the standard Logs index lifecycle policy, However this has a silly retention period, and i need to change this.

I have created an appropriate policy for what we need, but cannot for the life of me work out how to change the policy that is applied to the datastream.

Can anyone offer a step by step solution. (Ideally without any data loss)

TIA

2

Hello,

Could you please share the current default policy used & the datastream policy created by you in order to understand how this can be updated.

Thanks!!

3

Hi @ataylor Welcome to the community

Perhaps take a look at this

I think I provided some instructions here as well

1 Like
4

Hi Thats actually quite useful.

I guess the only remaining question is how do I apply that to the datastream I don't see that in what you added above?

Thanks in Advance.

5

When you rollover the datastream it will automatically be applied behind the scenes... to the new backing indices...

Try the tutorial in detail