# Lifecycle Policies per monitoring vm

**URL:** <https://discuss.elastic.co/t/lifecycle-policies-per-monitoring-vm/357194>\
**Category:** Elasticsearch\
**Created:** [April 11, 2024, 9:45am UTC](https://discuss.elastic.co/t/lifecycle-policies-per-monitoring-vm/357194 "2024-04-11T09:45:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mr.Tomas](https://avatars.discourse-cdn.com/v4/letter/m/dfb087/32.png) [@Mr.Tomas](https://discuss.elastic.co/u/Mr.Tomas)\
**Post date:** [April 11, 2024, 9:45am UTC](https://discuss.elastic.co/t/lifecycle-policies-per-monitoring-vm/357194/1 "2024-04-11T09:45:20Z")

</div>

Hello community!  
My first try with Elastic, still learning and reading the documentation. But decided to ask a question in parallel to my studies.

I got a task to collect events from ~100 windows servers.  
I’ve installed Elastic and Kibana on server, and Winlogbeat as an agent on windows vm.  
In the default installation I got the data stream "winlogbeat-8.13.2" and Index Lifecycle Policies "winlogbeat".  
At this point everything is work perfect right out of the box.

Now the tricky part. I want to be able to manage Lifecycle Policies per monitoring vm/group of vm.  
For example:  
server01 – store events for 7 days and then delete them  
server02 – store events for 30 days and then delete them  
group of servers server03-server10 – store events for 90 days and then delete them.  
etc.

And I want to have a dashboard which will show how many disks space all events consume per server, so maybe I need separate Data Stream for each vm.

Can you suggest how to achieve this kind of configuration?