My setup is fairly simple. I use Filebeat, with all the default options to send to Elastic Cloud. My cluster is sized with 200GB.
I see that each update of Filebeat is creating it's own ILM policy, and there's also an umbrella policy (called simply filebeat) that covers all indices.
Where should I perform my changes? Is it safe to assume the "filebeat" policy covers and takes precedence over the "version specific" versions?
Example below:
