I have a couple of questions about the management of ILM based on legacy index templates.
-
Previously I have created a number of new index lifecycle policies with custom config for each of the beats being used. These policies are assigned to the alias and they work as expected. That is until the solution is upgraded and then the ILM policy reverts to the default (original) policy for that beat. My current work around is to upgrade the solution, go into the relevant index template (e.g. filebeat-7.15.0) and then amend the ILM policy I wish to use. I also have to go to the current 'writeable' index for each beat, remove the default ILM policy and then assign the one i want to be used. So for example, I have a policy called 'filebeat-ILM-310521' which is assigned to alias 'filebeat-7.15.0'; but after I upgrade to 7.15.1, the policy assigned to 'filebeat-7.15.1' is the (default) ILM policy 'filebeat. That is until I take the action as described above. Is there a 'catch-all' index template that I should be aware of. Or should I create a new index template with an index pattern of 'filebeat-7*' or even 'filebeat-*' so that an ILM policy stays the same after upgrades? Or what is the preferred approach?
-
Following on from the above, I have a sizeable number of indices that have the default ILM policy applied after upgrades. I could go through older ones and delete and then manually via the UI remove the lifecycle policy and re-add the want to use. This gets a bit onerous. Is there a way, using dev tools, to assign (either replace or delete and re-add) a custom lifecycle policy so that the indices rollover using ILM per the custom policy settings. And ideally with a wildcard so that I can do multiple at once (for example I have approx 80 filebeat-7.14.0-* indices).
Hope that makes sense.
Thanks in advance
Neil