Index Templates for older filebeat

I migrated to a 7.4 cluster from a stand alone 5.x single test instance. I may have carried over some legacy bad habits so to speak. Attempting to implement ILM policies but exposing other issues.

I followed the same older example of shipping via filebeat to logstash and creating indices based on an index pattern. I never created any "index template" for these various indices and never really understood why it was required in the newer examples of shippers. I see mappings and shard settings so something is taking care of it.

Can I simply create a NEW index template for these pre-existing indices based on the index pattern so I can apply ILM policies to it? Will this cause an issue to the existing "rules" that are currently being applied to the filebeat indices based on index pattern?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.