# ILM : configuration and pricing

**URL:** <https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [December 31, 2019, 10:47am UTC](https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437 "2019-12-31T10:47:48Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![icirco](https://avatars.discourse-cdn.com/v4/letter/i/dec6dc/32.png) [@icirco](https://discuss.elastic.co/u/icirco)\
**Post date:** [December 31, 2019, 10:47am UTC](https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437/1 "2019-12-31T10:47:48Z")

</div>

hello,

In my filebeat (7.4) configuration I setup an index template. In a recent Topic, I known that is important to setup setup.ilm.enabled to false to run an index template.

filebeat.yml :

```
 setup.ilm.enabled: false

setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 0
setup.template.enabled: true
setup.template.name: "filebeat-mytest-%{[agent.version]}"
setup.template.pattern: "filebeat-mytest-%{[agent.version]}-*"

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
  index: "filebeat-%{[agent.version]}-mytest-%{+yyyy.MM.dd}"

```

Now, I want to work with ILM policies on elasticsearch (7.4).  
It means that if ilm is disable in filebeat configuration, it is not possible to use ILM policies ?

In my kibana interface, I have the menu to configure ILM policies. But when I read the documentation, it seems that ILM policies configuration is in the x-pack, so I need a licence for use it ?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/2/52c18bb76bdff208d8c16d02228e2e76bf66b88d.png)

---

<div class="post-metadata">

**Author:** ![jakelandis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakelandis/32/36163_2.png) [@jakelandis](https://discuss.elastic.co/u/jakelandis)\
**Post date:** [January 2, 2020, 9:54pm UTC](https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437/2 "2020-01-02T21:54:42Z")

</div>

ILM is falls under the Basic license, which is free to use. See Basic [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/dynamic.html).

You don't need to configure ILM through filebeat, you can manage it directly through your [index template](https://www.elastic.co/guide/en/elasticsearch/reference/current/applying-policy-to-template.html).

The important parts are `index.lifecycle.name` in the index template, and if you use rollover, you must create the first index yourself - described here: [https://www.elastic.co/guide/en/elasticsearch/reference/current/\_actions.html#ilm-rollover-action](https://www.elastic.co/guide/en/elasticsearch/reference/current/_actions.html#ilm-rollover-action) and then add the`index.lifecycle.rollover_alias` to your index template. Those are the two main things that `setup.ilm.enabled` perform for you.

Manually managing ILM with `agent.version` in the index name can be challenging since the above steps need performed everytime you update the agent.version. I would advise to allow filebeat to manage the ILM setup if at all possible.

---

<div class="post-metadata">

**Author:** ![icirco](https://avatars.discourse-cdn.com/v4/letter/i/dec6dc/32.png) [@icirco](https://discuss.elastic.co/u/icirco)\
**Post date:** [January 3, 2020, 4:35pm UTC](https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437/3 "2020-01-03T16:35:19Z")

</div>

hi,

Thanks jakelandis, I'm now able to manage my index lifecycle. Here a sample :

```
PUT _template/mytest-network-test-tpl
{
  "index_patterns": ["mytest-network-test-*"], 
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0,
    "index.lifecycle.name": "policy_network", 
    "index.lifecycle.rollover_alias": "network-test"
  },
  "aliases": {
        "mytest-network-test" : {}
  }
}

PUT mytest-network-test-000001
{
  "aliases": {
    "network-test":{
      "is_write_index": true 
    }
  }
}

```

I still have a misunderstanding, it's about the filebeat definition when you want to modify the index name...

So, when I start my index lifecycle policy, what is the name of index when a index lifecycle policy is working ? Because of the iteration of the index name, filebeat configuration doesn't know the index name iterated ?

> output.elasticsearch:  
> hosts: ["localhost:9200"]  
> index: "mytest-network-test-000001"  
> **#index: "mytest-network-test-????"**

---

<div class="post-metadata">

**Author:** ![jakelandis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakelandis/32/36163_2.png) [@jakelandis](https://discuss.elastic.co/u/jakelandis)\
**Post date:** [January 3, 2020, 5:10pm UTC](https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437/4 "2020-01-03T17:10:07Z")

</div>

(assuming you disabled ILM via beats and are managing only via a template)

You will need to tell Filebeat to write to through the write/rollover alias you defined. `network-test` . That way when the rollover condition is met, ILM does the rollover and it changes the alias to point from -000001 to -000002.

The `mytest-network-test` alias you have defined doesn't hurt anything, but is not needed for ILM.

---

<div class="post-metadata">

**Author:** ![icirco](https://avatars.discourse-cdn.com/v4/letter/i/dec6dc/32.png) [@icirco](https://discuss.elastic.co/u/icirco)\
**Post date:** [January 6, 2020, 3:02pm UTC](https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437/5 "2020-01-06T15:02:23Z")

</div>

hello jakelandis,

I'm lost... 🙄

filebeat.yml :

> setup.ilm.enabled: false
> 
> setup.template.settings:  
> index.number\_of\_shards: 1  
> index.number\_of\_replicas: 0  
> index.lifecycle.name: policy\_network  
> index.lifecycle.rollover\_alias: mytest-network-test
> 
> setup.template.enabled: true  
> setup.template.name: "mytest-network-test-tpl"  
> setup.template.pattern: "mytest-network-test-\*"
> 
> output.elasticsearch:  
> index: "mytest-network-test"

I created my template in kibana like this :

> PUT \_template/mytest-network-test-tpl  
> {  
> "index\_patterns": [  
> "mytest-network-test-\*"  
> ],  
> "settings": {  
> "index": {  
> "lifecycle": {  
> "name": "policy\_network",  
> "rollover\_alias": "mytest-network-test"  
> },  
> "number\_of\_shards": "1",  
> "number\_of\_replicas": "0"  
> }  
> },  
> "aliases": {  
> "mytest-network-test": {}  
> }  
> }

when I fill my index, first, it create the index called "mytest-network-test" but no rollover\_alias is associate to the index....

---

<div class="post-metadata">

**Author:** ![jakelandis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakelandis/32/36163_2.png) [@jakelandis](https://discuss.elastic.co/u/jakelandis)\
**Post date:** [January 6, 2020, 3:20pm UTC](https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437/6 "2020-01-06T15:20:59Z")

</div>

Before any data is written you need to create the `-000001` index with the alias. With the above config:

1. Stop beats from sending data.
2. 

```auto
DELETE mytest-network-test

```

(\*note - the above will delete data)  
3.

```auto
PUT mytest-network-test-000001
{
  "aliases": {
    "mytest-network-test":{
      "is_write_index": true 
    }
  }
}

```

1. Start up beats to start ingesting data.

This should be mostly unnecessary if you allow beats to manage ILM. The beats config allows for modification to the index settings , and you need custom templates you can use template ordering to override the beats defaults. I still advise to let beats manage ILM for you if at all possible.

---

<div class="post-metadata">

**Author:** ![icirco](https://avatars.discourse-cdn.com/v4/letter/i/dec6dc/32.png) [@icirco](https://discuss.elastic.co/u/icirco)\
**Post date:** [January 9, 2020, 1:01pm UTC](https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437/7 "2020-01-09T13:01:44Z")

</div>

Dear jakelandis,

Thanks a lot for all informations : everything is running well now !

My mistake was I didn't create the first index.

So, to summary all steps :

config filebeat.yml :

> setup.ilm.enabled: false
> 
> setup.template.settings:  
> index.number\_of\_shards: 1  
> index.number\_of\_replicas: 0  
> index.lifecycle.name: policy\_network  
> index.lifecycle.rollover\_alias: mytest-network-test
> 
> setup.template.enabled: true  
> setup.template.name: "mytest-network-test-tpl"  
> setup.template.pattern: "mytest-network-test-\*"
> 
> output.elasticsearch:  
> index: "mytest-network-test"

create template index by specify rollover\_alias :

> PUT \_template/mytest-network-test-tpl  
> {  
> "index\_patterns": [  
> "mytest-network-test-\*"  
> ],  
> "settings": {  
> "index": {  
> "lifecycle": {  
> "name": "policy\_network",  
> "rollover\_alias": "mytest-network-test"  
> },  
> "number\_of\_shards": "1",  
> "number\_of\_replicas": "0"  
> }  
> }  
> }

create the FIRST index !

> PUT mytest-network-test-000001  
> {  
> "aliases": {  
> "mytest-network-test":{  
> "is\_write\_index": true  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2020, 1:01pm UTC](https://discuss.elastic.co/t/ilm-configuration-and-pricing/213437/8 "2020-02-06T13:01:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.