ILM for each module fileset

Elastic Stack Beats
,
3

Just in case anyone is following this or see this post i the future. I found the solution to this problem with this thread.

In a nutshell it describes setting up the index lifecycle settings however you want, then you add a template to your index and the key to all of this was to bootstrap the first index with URI encoding like so:

PUT /%3Cfilebeat-7.1.1-indexname-%7Bnow%2Fd%7D-1%3E {
"aliases": {
"indexname":{
"is_write_index": true
} } }

The URI encoding was what was missing for my previous attempts and this is what fixed it for me. Thanks to chandra2037 for this post.