We are leveraging the Kubernetes integration in Elastic Agents to collect data from multiple Kubernetes clusters. By default, indices created by the Kubernetes integration are assigned the metrics@lifecycle
ILM policy, which lacks a delete phase.
To address this, we created a custom component template (ilm_7_days@custom
) that references the ilm-7-days
ILM policy, designed to delete indices after 7 days. We added this custom component to the index template for the Kubernetes integration data streams, placing it at the bottom of the component list.
Initially, the custom ILM policy was successfully applied to the Kubernetes integration indices. However, after some time (approximately one day), we observed that the custom component was removed from the index template’s component list. Consequently, the indices reverted to using the default metrics@lifecycle
ILM policy.
We suspect that the Kubernetes integration is periodically resetting the index template or overriding custom changes. Is this expected behavior, or is there a configuration or workaround that would allow the custom ILM policy to persist for these indices?