I'm using ILM with filebeat. Right now I'm using the default configuration.
I'd like to adjust it a little bit now, but I'm not sure if what I want to do is actually possible. I'd like to have a separate index for some of my log messages - for instance one with severity DEBUG, because those should be removed earlier than the rest. Is that still possible with filebeat + ILM? If so, do you have any hints on how to achieve this?
You can. This currently get's a little complex though because you need to filter out those messages in Filebeat and then put them in their own index + ILM policy.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.