How to set default lifecycle deletion phase for filebeat & metricbeat post installation of ES node?

Elastic Stack Elasticsearch
1

Hi,
I am newbee to ES, I wanted to set default lifecycle deletion phase for filebeat and metricbeat lifecycle policy. I could see that by default the host phase already enabled in kibana. Same way i want delete phase also to be enabled soon after installation. Where should we look for ?. Is there any file to be modified ?.

Any help would be appreciated. Thanks in advance.

2

Hi @Vijaykumar_sanganala Welcome to the community.

What version of the stack?

You Should be able to go to

Kibana -> Stack Management > Index Lifecycle Policy -> metricbeat

Manage / Edit and set the Delete Phase (or any other settings you need)
Sometimes, adding the delete phase seems hidden.
Click the trash can and you will get a Delete Phase.

Screenshot 2024-12-06 at 9.33.28 AM
Screenshot 2024-12-06 at 9.33.28 AM1920×1180 119 KB

3

Hi @stephenb thank you very much for the reply. I am able to see the Delete Phase under Index Lifecycle Policies.

Delete_phase
Delete_phase1554×825 86.3 KB

My issue is how to get this phase enabled as and when you install EAA node. In other words I want this to be Activated already when you login Kibana.

Stack Version:
{ "name" : "elastic-2019", "cluster_name" : "carestream_es_cluster", "cluster_uuid" : "g3pQ3zc6Tm6lUwNISLDyQg", "version" : { "number" : "7.5.0", "build_flavor" : "default", "build_type" : "zip", "build_hash" : "e9ccaed468e2fac2275a3761849cbee64b39519f", "build_date" : "2019-11-26T01:06:52.518245Z", "build_snapshot" : false, "lucene_version" : "8.3.0", "minimum_wire_compatibility_version" : "6.8.0", "minimum_index_compatibility_version" : "6.0.0-beta1" }, "tagline" : "You Know, for Search" }

I hope this helps.

4

Apologies I don't know what that "EAA" means.

That is the default ILM policy... You will need to change it after you run setup.

You can make a REST API call to update it as soon as you like ...I am not sure what you are trying to do...

BTW You are on a very very old version.

And one more thing I just thought.
Elasticsearch or Kibana do not install anything that will delete data automatically as a default.
Deleting data always requires input or change or an update from a user. That behavior is by design.