# ILM problem **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [January 24, 2025, 6:48pm UTC](https://discuss.elastic.co/t/ilm-problem/373646 "2025-01-24T18:48:35Z")\ **Posts on this page:** 1\ **Showing post:** 12
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 25, 2025, 6:23pm UTC](https://discuss.elastic.co/t/ilm-problem/373646/12 "2025-01-25T18:23:23Z")
@Mehran_Noorani Ok now you are providing some context... You are trying to design a whole system. After reading that, I would recommend using Fleet and Elastic Agent, which is for the now and the future, not individual beats. They support OOTB data stream, datasets and name spaces, ingestion pipelines ILM etc...... which allow a better approach to segmentation, control, parsing etc. (I would still be carefull as over segmentation can cause issues) If I was building a system that would be my approach. For each "System" you need to identify what you will collect ... Are they "share / common" are the Specific Uncommon etc.. Are there common processing paths What has common and different Life Cycle Policies I would first do a spread sheet exercise of your inventory. I would read up on Elastic Agent, Integrations, Data stream etc > **[Fleet and Elastic Agent overview | Fleet and Elastic Agent Guide \[8.17\] |...](https://www.elastic.co/guide/en/fleet/current/fleet-overview.html)** > **[Data streams | Fleet and Elastic Agent Guide \[8.17\] | Elastic](https://www.elastic.co/guide/en/fleet/current/data-streams.html)** > [@Mehran\_Noorani](#): > > I need to extract and archive the logs of a specific program from within a single index after one month I don't know what that means... extract but ok... and I do not understand the focus on a single index... but OK as well... I think you are making assumptions about elastic data streams and indices which may or may not be correct.... If you are saying that there are different Lifecycles per System of something like that you need to think in terms of that... Top Down (requirement, retention etc) not Bottom up (per index etc) You can keep trying with your config... it is not going to work.. DO you have a requirement to be on Winlogbeat? or Would Elastic Agent Work... If you are stuck on winlogbeat Note you have to run `setup -e` once BEFORE you start writing data Take a look at this post it is for metricbeat but winlog beat works the same What this does is setup all the scafolding... > [@Metricbeat and Heartbeat 8.x custom index Name should pickup from template ,but creates always bedefault index name](https://discuss.elastic.co/t/metricbeat-and-heartbeat-8-x-custom-index-name-should-pickup-from-template-but-creates-always-bedefault-index-name/337557/9): > > can you please try exactly my example Not correct that is what is causing the issue.. Can you please try Exactly my config just change the host and u/p. output.elasticsearch: hosts: ["https://localhost:9200"] index: "cis-metric-%{[agent.version]}" username: "elastic" password: "password" ssl.verification\_mode: "none" setup.ilm.enabled: true setup.ilm.check\_exists: true setup.ilm.rollover\_alias: cis-metric setup.ilm.pattern: '{now/d}-000001' setup.ilm.overwrite: false setup.templ… Its a more complete version of this... > **[Change the index name | Winlogbeat Reference \[8.17\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/8.17/change-index-name.html)** There is another approach as well when you use data streams.. Look at this... > [@Filebeat Elasticsearch output data stream?](https://discuss.elastic.co/t/filebeat-elasticsearch-output-data-stream/371562/3): > > Example: Can be set per input filebeat.inputs: - type: filestream id: my-filestream-id enabled: true paths: - /var/log/\*.log fields\_under\_root: true fields: data\_stream.type: logs data\_stream.dataset: my.app data\_stream.namespace: prod event.dataset: my.app setup.ilm.enabled: false setup.template.enabled: false # setup.template.settings: # index.number\_of\_shards: 1 setup.kibana: output.elasticsearch: hosts: ["http://localhost:9200"] index: "%{[data\_stream.… Ok ... out ... think about what you want to do... I will check check back in at some point But we can't design your whole system. We can only provide you direction... --- _[View the full topic](https://discuss.elastic.co/t/ilm-problem/373646)._