Is there a way to apply a lifecycle management policy only to metricbeat-* pattern index?

Elastic Stack Beats
1

Is there a way to apply a life cycle management policy only to metricbeat-* pattern index in 7.4 logstash/Elasticsearch/kibana cluster to delete any index older than 30 days?

2

Yes possible, check theses links

https://www.elastic.co/guide/en/beats/metricbeat/current/ilm.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html

3

Thanks, here is what I have done

  • Created a new lifecycle management policy named it metricbeat_cleaup that delete index every 7days
  • Create a new index template that associate new created daily index to my policy

PUT _template/metricbeat_template
{
"index_patterns": ["metricbeat-*"],
"settings": {
"number_of_shards": 3,
"index.lifecycle.name": "metricbeat_cleanup"

}
}

Will be monitoring if all went Ok.

Thanks for your help