# ILM policy being over written

**URL:** <https://discuss.elastic.co/t/ilm-policy-being-over-written/188582>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [July 2, 2019, 9:59pm UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582 "2019-07-02T21:59:50Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [July 2, 2019, 9:59pm UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582/1 "2019-07-02T21:59:51Z")

</div>

Hi

This is a basic question. But can you please clarify.

I have a setting in my file beat configuration.

```
setup.ilm.enabled: auto

# Configure the ILM write alias name.
setup.ilm.rollover_alias: "metricbeat"

# Configure rollover index pattern.
setup.ilm.pattern: "{now/d}-000001"

```

I am installing beats on multiple server. I see with every installation the version of the ILM policy is changing. So I assume its being over written.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a6573a76b87c920f1a220d81979f0d6aaeb0b0f5.png)

So I tried to change the setting of this from `setup.ilm.enabled: auto` to `setup.ilm.enabled: false`. But the installation is failing if I do this.

I also manually changed the configuration of ILM to delete the index after 1 year but its changing to 30 days.

Can you please tell me how I can just set this once and make sure that is not over written with every installation of beats agent.

---

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [July 3, 2019, 6:00am UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582/2 "2019-07-03T06:00:31Z")

</div>

I am just sharing what i have done.  
I overwrite it with the same config i set each time i run `filebeat setup -e`

You can read up on `setup.ilm.check_exists:` & `setup.ilm.overwrite:` settings in the docs.

```
setup.ilm.enabled: true

setup.ilm.policy_name: "filebeat-7.0.1"

setup.ilm.policy_file: "/etc/filebeat/filebeat-7.0.1.json"

setup.ilm.check_exists: false

setup.ilm.overwrite: true

setup.ilm.rollover_alias: "filebeat-linuxclient"

setup.ilm.pattern: "{now/d}-000001"

```

My filebeat-7.0.1.json file:

```
{
    "policy": {
        "phases": {
            "hot": {
                "min_age": "0ms",
                "actions": {
                    "rollover": {
                        "max_age": "1d",
                        "max_size": "15gb"
                    }
                }
            },
            "warm": {
                "min_age": "30d",
                "actions": {}
            },
            "cold": {
                "min_age": "60d",
                "actions": {}
            },
            "delete": {
                "min_age": "90d",
                "actions": {
                    "delete": {}
                }
            }
        }
    }
}

```

With this, even if it overwrites, it will overwrite with the policy you have set. However, you need to rollover the indices manually for them to be in sync to the same version.

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [July 3, 2019, 3:43pm UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582/3 "2019-07-03T15:43:07Z")

</div>

@TsuWeiQuan Thanks for your reply. Though your settings work. I believe we must not overwrite the settings which is set once.

It is better if we manage this setting from one place rather than overwriting every time when we install beats agent.

I can set this from the admin settings page. But I want to remove this from beats configuration.

---

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [July 3, 2019, 3:56pm UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582/4 "2019-07-03T15:56:37Z")

</div>

> [@TsuWeiQuan](#):
>
> setup.ilm.check\_exists: false setup.ilm.overwrite: true

Yes, you are right. You can set  
setup.ilm.check\_exists: true  
setup.ilm.overwrite: false  
to disable overwrite too. I recalled i had some issue with it hence i did it the overwrite method for the time being

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [July 3, 2019, 3:57pm UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582/5 "2019-07-03T15:57:54Z")

</div>

Thank you. Let me try this setting.

---

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [July 4, 2019, 3:20am UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582/6 "2019-07-04T03:20:06Z")

</div>

```
setup.ilm.check_exists: true
setup.ilm.overwrite: false

```

I presume that there is a bug in these settings.  
Even tho ilm overwrite was set to false. Running `filebeat setup -e` would still overwrite the policy.  
Similar scenario appears in metricbeat too.

```
2019-07-04T11:15:00.216+0800 INFO [index-management] idxmgmt/std.go:400 Set settings.index.lifecycle.rollover_alias in template to {metricbeat-cei2sitsvr {now/d}-000001} as ILM is enabled.
2019-07-04T11:15:00.216+0800 INFO [index-management] idxmgmt/std.go:404 Set settings.index.lifecycle.name in template to {metricbeat-7.0.1 map[policy:map[phases:map[cold:map[min_age:3d actions:map[]] delete:map[min_age:5d actions:map[delete:map[]]] hot:map[min_age:0ms actions:map[rollover:map[max_age:1dmax_size:15gb]]] warm:map[min_age:3d actions:map[]]]]]} as ILM is enabled.
```

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [July 9, 2019, 6:19pm UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582/7 "2019-07-09T18:19:44Z")

</div>

@Kaiyan_Sheng Can you please help with this issue or redirect us to the right person. Thank you.

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [July 10, 2019, 11:55pm UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582/8 "2019-07-10T23:55:44Z")

</div>

@TsuWeiQuan I tried the settings and Yes it does not work and overwrite the ILM policy settings.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2019, 11:55pm UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582/9 "2019-08-07T23:55:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
