# ILM for new indices created via Logstash

**URL:** <https://discuss.elastic.co/t/ilm-for-new-indices-created-via-logstash/346621>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [November 7, 2023, 1:40pm UTC](https://discuss.elastic.co/t/ilm-for-new-indices-created-via-logstash/346621 "2023-11-07T13:40:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tecbox41](https://avatars.discourse-cdn.com/v4/letter/t/a88e57/32.png) [@tecbox41](https://discuss.elastic.co/u/tecbox41)\
**Post date:** [November 7, 2023, 1:40pm UTC](https://discuss.elastic.co/t/ilm-for-new-indices-created-via-logstash/346621/1 "2023-11-07T13:40:33Z")

</div>

I am trying to apply ILM to new indices created via Logstash, but it doesn't seem to show the new indices being managed by ILM. I am using the default index template and do not have streams configured for these indices. The daily indices get created fine via Logstash, but they just aren't being managed by ILM.

I created the ILM policy first, then made the change to the Logstash .cfg files, and then restarted Logstash.

The "_output_" section of my logstash file is as follows:

```auto
output
{
        elasticsearch
        {
          index => "casper-%{[@metadata][version]}-%{+YYYY.MM.dd}"
          ilm_policy => "mylogs_policy"
          ...

```

Is it enough to set "_ilm\_policy_" in the .cfg files for Logstash? Based on the Elastic documentation, "_ilm\_enabled_" should be detected automatically.

My ILM policy:

```auto
PUT _ilm/policy/mylogs_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {},
        "min_age": "0ms" }
      },
      "delete": {
        "min_age": "30d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

```

Index ILM status:

```auto
GET casper-8.8.2-2023.11.07/_ilm/explain

{
  "indices": {
    "casper-8.8.2-2023.11.07": {
      "index": "casper-8.8.2-2023.11.07",
      "managed": false
    }
  }
}

```

When I apply the ILM policy to existing indices, it is successful and shows the existing indices as being managed by ILM.

Running Elastic 8.8.2.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2023, 1:41pm UTC](https://discuss.elastic.co/t/ilm-for-new-indices-created-via-logstash/346621/2 "2023-12-05T13:41:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.