# ILM policy is changing without editing it

**URL:** https://discuss.elastic.co/t/ilm-policy-is-changing-without-editing-it/249539
**Category:** Elasticsearch
**Tags:** ilm-index-lifecycle-management
**Created:** [September 22, 2020, 2:53pm UTC](https://discuss.elastic.co/t/ilm-policy-is-changing-without-editing-it/249539 "2020-09-22T14:53:02Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Abdelhalim](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)
#### Post date: [September 22, 2020, 2:53pm UTC](https://discuss.elastic.co/t/ilm-policy-is-changing-without-editing-it/249539/1 "2020-09-22T14:53:02Z")

</div>

Hello everybody,

I created an ILM policy :

```auto
PUT _ilm/policy/hot-warm-cold-delete-60days-policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size":"20gb",
            "max_age":"30d"
          },
          "set_priority": {
            "priority": 50
          }
        }
      },
      "warm": {
        "actions": {
          "forcemerge": {
            "max_num_segments": 1
          },
          "shrink": {
            "number_of_shards": 1
          },
          "allocate": {
            "require": {
              "data": "warm"
            }
          },
          "set_priority": {
            "priority": 25
          }
        }
      },
      "cold": {
        "min_age": "30d",
        "actions": {
          "set_priority": {
            "priority": 0
          },
          "freeze": {},
          "allocate": {
            "require": {
              "data": "cold"
            }
          }
        }
      },
      "delete": {
        "min_age": "60d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

```

and then I created a template

```auto
PUT _template/packetbeat
{
  "index_patterns": ["packetbeat-*"], 
  "settings": {
    "number_of_shards": 10,
    "number_of_replicas": 1,
    "index.lifecycle.name": "hot-warm-cold-delete-60days-policy",  
    "index.lifecycle.rollover_alias": "packetbeat"
  }
}

```

and then create the first index :

```auto
PUT packetbeat-000001
{
  "aliases": {
    "packetbeat": {
      "is_write_index": true
    }
  }
}

```

It was working perfectly, but after 2 days I went to see the policy configuration and I found that the configuration changed and it's not the first time that arrives, even when I edit it it begin working and then after some time it changes again.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a54a4155e766c94c26109f0dea0904bcb967ec2e.png)

Could someone tell me what I am doing wrong please ?

Thanks for your help

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 23, 2020, 10:23pm UTC](https://discuss.elastic.co/t/ilm-policy-is-changing-without-editing-it/249539/2 "2020-09-23T22:23:12Z")

</div>

Someone, or something must be changing this.

You wouldn't happen to be running setup from any other Packetbeat instances would you?

---

<div class="post-metadata">

### Author: ![Abdelhalim](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)
#### Post date: [September 24, 2020, 2:24pm UTC](https://discuss.elastic.co/t/ilm-policy-is-changing-without-editing-it/249539/3 "2020-09-24T14:24:45Z")

</div>

Thanks for your reply @warkolm

I am the only one who have access to the cluster, so we can exclude your first supposition.  
Now I am running this policy just for firewall logs, the other beats (packetbeat, winlogbeat, audibbeat) I let them use the default policy.  
I run setup for the other beats after configuring the firewall policy, but they are not using the same policy, so it shouldn't be the cause isn't it ?

Just for information, I am using Elasticsearch and Kibana from code source, so it's the version 8.0.0

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 22, 2020, 2:24pm UTC](https://discuss.elastic.co/t/ilm-policy-is-changing-without-editing-it/249539/4 "2020-10-22T14:24:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.