# ILM is not being disabled in Metricbeat 7.2.1 and 7.3.1
**URL:** https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034
**Category:** Beats
**Created:** [October 2, 2019, 6:53pm UTC](https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034 "2019-10-02T18:53:29Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@George\_Wainwright](https://discuss.elastic.co/u/George_Wainwright)
#### Post date: [October 2, 2019, 6:53pm UTC](https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034/1 "2019-10-02T18:53:29Z")
I am trying to disable ILM in metricbeat 7.2.1 and 7.3.1 in output elasticsearch section but it doesn't work.
```
metricbeat.config.modules:
path: ${path.config}/modules.d/*.yml
output:
elasticsearch:
hosts:
- 192.168.33.10:9200
setup.ilm.enabled: false
setup.ilm.check_exists: false
index: metricbeat-%{[metricset.module]}-%{+YYYY}.week.%{+ww}
indices:
- index: metricbeat-%{[metricset.module]}-%{+yyyy.MM.dd}
when.equals:
metricset.module: system
password: pass
protocol: http
username: user
setup.dashboards.enabled: true
setup.dashboards.index: metricbeat-*
setup.kibana:
host: 192.168.33.10:5601
password: pass
protocol: http
username: user
setup.template.fields: /etc/metricbeat/fields.yml
setup.template.name: metricbeat7
setup.template.overwrite: false
setup.template.pattern: metricbeat-*
```
What is wrong? Is there a bug for that?
---
### Author:  [@dedemorton](https://discuss.elastic.co/u/dedemorton)
#### Post date: [October 2, 2019, 7:33pm UTC](https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034/2 "2019-10-02T19:33:37Z")
I can't tell the structure of your config file. Can you please format it as code?
The setup options belong at the root, not under the elasticsearch output section. You can see the required structure in the reference.yml file here: [https://www.elastic.co/guide/en/beats/metricbeat/7.3/metricbeat-reference-yml.html](https://www.elastic.co/guide/en/beats/metricbeat/7.3/metricbeat-reference-yml.html)
---
### Author:  [@George\_Wainwright](https://discuss.elastic.co/u/George_Wainwright)
#### Post date: [October 2, 2019, 8:07pm UTC](https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034/3 "2019-10-02T20:07:35Z")
@dedemorton
I've formatted my code. Sorry for that.
Yes I tried to disable ILM via setup in root, but in this case I catch ERROR because of which indices are not being sent to Elastic :
```
2019-10-02T20:07:05.645Z INFO [publisher] pipeline/retry.go:155 Drop batch
2019-10-02T20:07:07.393Z ERROR pipeline/output.go:121 Failed to publish events: temporary bulk send failure
```
---
### Author:  [@dedemorton](https://discuss.elastic.co/u/dedemorton)
#### Post date: [October 2, 2019, 11:46pm UTC](https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034/4 "2019-10-02T23:46:11Z")
I think you have a few problems with your config:
- `setup.ilm` settings belong at the root.
- `metricset.module` doesn't exist in the output as far as I can see. Did you try `event.module`?
- possibly some indentation errors (I'm not great at eyeballing stuff).
This `indices` setting in 7.3.2 worked for me:
```auto
indices:
- index: "metricbeat-%{[event.module]}-%{+yyyy.MM.dd}"
when.equals:
event.module: "system"
```
---
### Author:  [@dedemorton](https://discuss.elastic.co/u/dedemorton)
#### Post date: [October 2, 2019, 11:52pm UTC](https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034/5 "2019-10-02T23:52:42Z")
If you're working from an older config or example, note that there were quite a few naming changes for fields in 7.0 with the migration to the Elastic Common Schema: [https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-7.0.html](https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-7.0.html)
---
### Author:  [@dedemorton](https://discuss.elastic.co/u/dedemorton)
#### Post date: [October 3, 2019, 12:07am UTC](https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034/6 "2019-10-03T00:07:33Z")
Here's the simplified config that worked for me on 7.3.2 (mostly defaults):
```auto
setup.ilm.enabled: false
setup.ilm.check_exists: false
metricbeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 1
index.codec: best_compression
setup.kibana:
cloud.id: "MyStack:somelongstring"
cloud.auth: "elastic:mypass"
output.elasticsearch:
hosts: ["localhost:9200"]
indices:
- index: "metricbeat-%{[event.module]}-%{+yyyy.MM.dd}"
when.equals:
event.module: "system"
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
```
---
### Author:  [@George\_Wainwright](https://discuss.elastic.co/u/George_Wainwright)
#### Post date: [October 3, 2019, 6:41am UTC](https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034/7 "2019-10-03T06:41:58Z")
@dedemorton,
thank you so much! The problem in my syntax when I tried setup ILM in root was that instead of `metricset.module` I should use `event.module` like you mentioned. Now it works as it should. Thanks a lot again!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 31, 2019, 8:42am UTC](https://discuss.elastic.co/t/ilm-is-not-being-disabled-in-metricbeat-7-2-1-and-7-3-1/202034/8 "2019-10-31T08:42:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.