ILM with custom index names

[michielM (Michiel)]

Hi, I have set-up my stack to use custom index names like filebeat-department-01/01/2000

To do this I had to disable ILM, but this means Elasticsearch creates daily indexes. Is it possible to have these custom index names and setup an ILM to rollover only if the file size is greater than 50Gb for example?

[hunsw (Attila)]

One way to solve this is to create indices for your departments, e.g. filebeat-marketing, filebeat-accounting, etc., applying ILM/rollover policies on these then creating filtered aliases for the indices, e.g.

POST /_aliases
{
    "actions" : [
        {
            "add" : {
                 "index" : "filebeat-accounting",
                 "alias" : "filebeat-accounting-01/01/2000",
                 "filter" : { ENTER_YOUR_DATE_RANGE_QUERY HERE }
            }
        }
    ]
}

[warkolm (Mark Walkom)]

Why did you need to disable ILM to do this? What did/does your policy look like?

[michielM (Michiel)]

I needed to disable the policy to create custom index names. The previous policy just used filebeat-7.6.1-01/01/2000 and I wanted to create filebeat-department-01/01/2000, but only create a new index after the index size is greater than 50GB.