# ILM Setup support for ELK 8.3

**URL:** <https://discuss.elastic.co/t/ilm-setup-support-for-elk-8-3/345061>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [October 16, 2023, 4:09am UTC](https://discuss.elastic.co/t/ilm-setup-support-for-elk-8-3/345061 "2023-10-16T04:09:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shailendra1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shailendra1/32/122783_2.png) [@shailendra1](https://discuss.elastic.co/u/shailendra1)\
**Post date:** [October 16, 2023, 4:09am UTC](https://discuss.elastic.co/t/ilm-setup-support-for-elk-8-3/345061/1 "2023-10-16T04:09:02Z")

</div>

Dear All,

i am looking some suggestions for setting up the ILM for my data/streaming/beats . i have below senerios to accomplished and keep running my platforms.

1. Everyday the indices are generating with **abc.yyy.mm.dd** format, without any data size limits of indices within the logstash mapping and patterns, the problem here how can i setup my ILM to avoid the flood of data sizes (regular pattern is around 1gb data but suddenly if data comes to 50gb)

2. can we setup ILM policy or rollover configuration in the Logstash pipelines with a indices size limits?

3. is there any better approach to keep my platform up and running with limited to the disk spaces/cluster storages.

4. i am using the ELK 8.3 with FB agents in multiple hosts.

Thank you in advance for your early responses and suggestions.

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [October 17, 2023, 12:53pm UTC](https://discuss.elastic.co/t/ilm-setup-support-for-elk-8-3/345061/2 "2023-10-17T12:53:09Z")

</div>

it sounds like you are looking for the ilm rollover action based on index size:

> **[Rollover | Elasticsearch Guide \[8.3\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.3/ilm-rollover.html#ilm-rollover-size-ex)**

This would rollover (create a new index) when the current reaches the configured size (checks every 10 min).

e.g:

```json
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover" : {
            "max_size": "5gb"
          }
        }
      },
      "delete": {
        "min_age": "2h"
      }
    }
  }
}

```

This policy would create indices of roughly 5gb and after rollover keep your data for an additional 2h.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 14, 2023, 12:53pm UTC](https://discuss.elastic.co/t/ilm-setup-support-for-elk-8-3/345061/3 "2023-11-14T12:53:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.