# How to handle ILM for managed system data streams (logs, metrics)

**URL:** <https://discuss.elastic.co/t/how-to-handle-ilm-for-managed-system-data-streams-logs-metrics/389330>\
**Category:** Elasticsearch\
**Created:** [August 8, 2026, 5:21pm UTC](https://discuss.elastic.co/t/how-to-handle-ilm-for-managed-system-data-streams-logs-metrics/389330 "2026-08-08T17:21:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rex656](https://avatars.discourse-cdn.com/v4/letter/r/e480ec/32.png) [@rex656](https://discuss.elastic.co/u/rex656)\
**Post date:** [August 8, 2026, 5:21pm UTC](https://discuss.elastic.co/t/how-to-handle-ilm-for-managed-system-data-streams-logs-metrics/389330/1 "2026-08-08T17:21:16Z")

</div>

I recently migrated from beats to fleet managed agents (about 500 servers total, mostly windows) and am wondering what best practice is for managing the system managed data streams for logs and metrics (logs-system\*_, metrics-system_\*).

With beats, all my data was being indexed into a single data stream. Now, with the agent, there’s several data streams - for each telemetry type and their subtype.

My predicament is that these new managed data streams can take awhile small depending on the data it’s collecting. For instance, the metrics-uptime data stream only ingests about 500mb every 6 months. The metrics-process data stream ingests about 100gb per month (we’re collecting metrics for a bunch of custom processes). The other data stream ingest at a different rate as what I mentioned above.

What would make sense as far as ILM goes if I want to retain data for a minimum of a year but I want as few ILMs to manage as possible? Is it possible to set a minimum shard or index size before rollover?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 8, 2026, 8:07pm UTC](https://discuss.elastic.co/t/how-to-handle-ilm-for-managed-system-data-streams-logs-metrics/389330/2 "2026-08-08T20:07:41Z")

</div>

Hi @rex656

In short

You create your own custom ilm policy

And you create your appropriate `...@custom` component template which names the policy

Deploy them

Roll over and you're on your way

> **[Tutorials: Customize data retention policies | Elastic Docs](https://www.elastic.co/docs/reference/fleet/data-streams-ilm-tutorial)**
>
> These tutorials explain how to apply a custom ILM policy to an integration’s data stream. For certain features you’ll need to use a slightly different...

Example (pick use case one two or three this is two)

> **[Scenario 2: Apply an ILM policy to specific data streams generated from Fleet...](https://www.elastic.co/docs/reference/fleet/data-streams-scenario2)**
>
> Mappings and settings for data streams can be customized through the creation of \*@custom component templates, which are referenced by the index templates...