# ILM strategy for filebeat, metricbeat and apm indices **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [June 15, 2021, 1:33pm UTC](https://discuss.elastic.co/t/ilm-strategy-for-filebeat-metricbeat-and-apm-indices/276008 "2021-06-15T13:33:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![aksh\_18](https://avatars.discourse-cdn.com/v4/letter/a/839c29/32.png) [@aksh\_18](https://discuss.elastic.co/u/aksh_18)\ **Post date:** [June 15, 2021, 1:33pm UTC](https://discuss.elastic.co/t/ilm-strategy-for-filebeat-metricbeat-and-apm-indices/276008/1 "2021-06-15T13:33:18Z")
Hi Team, I have 1 node elasticsearch cluster, which has 60GB RAM , 1.2 TB disk. I have 1 filebeat and 1 metricbeat index each receiving 6 GB data per day and 1 apm index which is receiving 10GB data per day. I want to retain 60 days' data and delete 1st day's data on 61st day (for each index). If you could propose strategy for implementing this ILM, it would be really helpful. Also I have below questions: 1. How much disk space I would require? 2. What would be effect on CPU usage for this much data and do I need to increase RAM? 3. How increasing shards for indices will help in this situation? Thanks ! ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [June 15, 2021, 1:40pm UTC](https://discuss.elastic.co/t/ilm-strategy-for-filebeat-metricbeat-and-apm-indices/276008/2 "2021-06-15T13:40:55Z")
Hi @aksh_18! Since your questions are not filebeat/metricbeat specific but mostly about Elasticsearch, could you please redirect them to Elasticsearch's topics so as to get help from the team there? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 15, 2021, 10:41pm UTC](https://discuss.elastic.co/t/ilm-strategy-for-filebeat-metricbeat-and-apm-indices/276008/3 "2021-06-15T22:41:00Z")
Welcome to our community! 😃 Please make sure you have read the Elasticsearch [ILM](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html) documentation, as well as the relevant docs for both of your Beats. Once you've got that setup, configure your policy to match the required retention rate and you should be good to go! ---
**Author:** ![aksh\_18](https://avatars.discourse-cdn.com/v4/letter/a/839c29/32.png) [@aksh\_18](https://discuss.elastic.co/u/aksh_18)\ **Post date:** [June 23, 2021, 8:40am UTC](https://discuss.elastic.co/t/ilm-strategy-for-filebeat-metricbeat-and-apm-indices/276008/4 "2021-06-23T08:40:26Z")
Hi Team, If I follow this approach , will it be correct for 2 node cluster with one HOT and 1 WARM node? Also is it possible to have HOT and WARM phases in the same node? ( Note: 24GB data is getting ingested per day and filebeat, metircbeat , apm-transaction and apm-span are having 12 indices each. So at a time 4 indices, one from each agent , will be in HOT phase) ![IndicesFile](https://us1.discourse-cdn.com/elastic/original/3X/f/f/fff4ab19aa7c05f44f178dd806bc56c8c0f276c8.png) Here I am keeping minimum 55 days data and after every 5 days , deleting oldest index ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 23, 2021, 8:42am UTC](https://discuss.elastic.co/t/ilm-strategy-for-filebeat-metricbeat-and-apm-indices/276008/5 "2021-06-23T08:42:04Z")
That looks ok. > [@aksh\_18](#): > > Also is it possible to have HOT and WARM phases in the same node Yes. But the data obviously won't move. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 21, 2021, 10:42am UTC](https://discuss.elastic.co/t/ilm-strategy-for-filebeat-metricbeat-and-apm-indices/276008/6 "2021-07-21T10:42:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.