How to define a global default index route allocation strategy?

PUT filebeat-7.17.3-000001/
  "settings": {
    "index": {
      "lifecycle": {
        "name": "30-days-default",
        "rollover_alias": "filebeat-7.17.3"
      "routing": {
        "allocation": {
          "include": {
            "_tier_preference": "data_hot,data_warm"
          "require": {
            "data": "hot_warm",
            "size": "3T"

I hope that all external tools can route data to the data_hot node when writing data to
Elasticsearch. I read the documentation, the default routing node is data_content, but I found that there is no configuration that can directly set the global definition, although it can be created through create index API or index template explicitly set "index.routing.allocation.include._tier_preference": "data_hot",
But both approaches are post-hoc.
For example, if I want filebeat data to be routed to data_hot, but I want filebeat to use its own imported index template, then I need to start filebeat first, and then modify its index template. Is there a best practice?

I have seen:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.