ILM and custom index names

Elastic Stack Beats
,
1

Hi,

I'm using ILM with filebeat. Right now I'm using the default configuration.

I'd like to adjust it a little bit now, but I'm not sure if what I want to do is actually possible. I'd like to have a separate index for some of my log messages - for instance one with severity DEBUG, because those should be removed earlier than the rest. Is that still possible with filebeat + ILM? If so, do you have any hints on how to achieve this? :thinking:

2

You can. This currently get's a little complex though because you need to filter out those messages in Filebeat and then put them in their own index + ILM policy.

3

In that case I would need to manually define the ILM policies though, right?

4

Correct.