# ILM using custom Logstash indices

**URL:** <https://discuss.elastic.co/t/ilm-using-custom-logstash-indices/269239>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [April 5, 2021, 1:46pm UTC](https://discuss.elastic.co/t/ilm-using-custom-logstash-indices/269239 "2021-04-05T13:46:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Danilo\_PC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danilo_pc/32/81564_2.png) [@Danilo\_PC](https://discuss.elastic.co/u/Danilo_PC)\
**Post date:** [April 5, 2021, 1:46pm UTC](https://discuss.elastic.co/t/ilm-using-custom-logstash-indices/269239/1 "2021-04-05T13:46:44Z")

</div>

Hi,

I’m using logstash to ingest data into my elasticloud ES.

I’m using custom index names, such as “client\_name-winlogbeat-2021.03.05” and “client\_name-o365-2021.03.05” for windows and office 365 logs respectively.

By doing so, I’m unable to configure ILM for those indices.

An example of my logstash configuration can be seen as follow:

```auto
    input {
      syslog {
        port => 9001
        codec => cef
        type => "syslog_server"
        tags => ["office365"]

      }
    }

    output {
      if "icts-carbon-black" in [tags] {
        elasticsearch {
          hosts => ["ip:port"]
          user => "user"
          password => "pass"
          manage_template => false
          ssl => true
          ssl_certificate_verification => false
          index => "client-o365-%{+YYYY.MM.dd}"
        }
      }
    }

```

I’d like to ask how can I enable ILM policies for those custom indexes.

Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 6, 2021, 1:06am UTC](https://discuss.elastic.co/t/ilm-using-custom-logstash-indices/269239/2 "2021-04-06T01:06:23Z")

</div>

You can't use ILM and timebased indices like that;

> You cannot use dynamic variable substitution when `ilm_enabled` is `true` and when using `ilm_rollover_alias` .

Please take a look at [Elasticsearch output plugin | Logstash Reference [7.12] | Elastic](https://www.elastic.co/guide/en/logstash/7.12/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2021, 1:07am UTC](https://discuss.elastic.co/t/ilm-using-custom-logstash-indices/269239/3 "2021-05-04T01:07:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.