# ILM and output.elasticsearch.indices

**URL:** <https://discuss.elastic.co/t/ilm-and-output-elasticsearch-indices/207634>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 13, 2019, 6:39am UTC](https://discuss.elastic.co/t/ilm-and-output-elasticsearch-indices/207634 "2019-11-13T06:39:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![andye](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andye/32/61838_2.png) [@andye](https://discuss.elastic.co/u/andye)\
**Post date:** [November 13, 2019, 6:39am UTC](https://discuss.elastic.co/t/ilm-and-output-elasticsearch-indices/207634/1 "2019-11-13T06:39:45Z")

</div>

Currently using fluentbit to read in docker log files and forward on to elasticsearch and thinking about moving over to Filebeats to try to take advantage of the new ILM features.

We currently have some application specific indices being created daily and are having to manually add them into the ILM policy we have defined. We need to do this as fluentbit currently doesn't support index alias for ILM.

I've been going through the official docs today and although I can create custom indices by doing something like:-

```auto
output.elasticsearch:
  hosts: ["http://localhost:9200"]
  indices:
    - index: "warning-%{[agent.version]}-%{+yyyy.MM.dd}"
      when.contains:
        message: "WARN"
    - index: "error-%{[agent.version]}-%{+yyyy.MM.dd}"
      when.contains:
        message: "ERR"

```

and having a template to match, it seems that ILM can only be set for a single index, e.g.

```auto
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "filebeat-%{agent.version}"
setup.ilm.pattern: "{now/d}-000001"

```

Am I missing something here? Is it possible to remove the date portion from the indexes and also pass multiple values into `setup.ilm.rollover_alias`?

My actual use case doesn't use dynamic index names, or needn't have to, e.g.

```auto
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "app1-%{agent.version}", "app2-%{agent.version}"
setup.ilm.pattern: "{now/d}-000001"

output.elasticsearch:
  hosts: ["http://localhost:9200"]
  indices:
    - index: "app1-%{agent.version}"
      when.contains:
        message: "app1"
    - index: "app2-%{agent.version}"
      when.contains:
        message: "app2"

```

EDIT: Change naming to reflect more closely actual usage.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2019, 6:39am UTC](https://discuss.elastic.co/t/ilm-and-output-elasticsearch-indices/207634/2 "2019-12-11T06:39:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.