How to change the policy of an existing datastream

[stephenb (Stephen Brown)]

Hi @ataylor Welcome to the community

Perhaps take a look at this

Tutorials: Customize data retention policies | Fleet and Elastic Agent Guide...

I think I provided some instructions here as well

[BIG-IP ASM] Could not index event to Elasticsearch

See here how to customize ILM for a data stream... Basically Clone the existing Policy and Edit to your liking and give it a name... like logs-custom Add a custom template you can do through the UI or this is the whole request in Kibana - Dev Tools PUT _component_template/logs@custom { "template": { "settings": { "index": { "lifecycle": { "name": "logs-custom" } } } } } If you are going to use agents... you must use data streams If you wan…