# LifeCycle Policy Configuration

**URL:** <https://discuss.elastic.co/t/lifecycle-policy-configuration/198503>\
**Category:** Elasticsearch\
**Created:** [September 7, 2019, 10:59am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503 "2019-09-07T10:59:09Z")\
**Posts on this page:** 19\
**Page:** 2

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 12, 2019, 1:08pm UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/21 "2019-09-12T13:08:29Z")

</div>

OK thank you very much. I will see this.

---

<div class="post-metadata">

**Author:** ![dgonzalezp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dgonzalezp/32/50804_2.png) [@dgonzalezp](https://discuss.elastic.co/u/dgonzalezp)\
**Post date:** [September 13, 2019, 6:44am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/22 "2019-09-13T06:44:53Z")

</div>

Hi again @antonopo  
I have discovered the reason why your logs from metricbeat are going to metricbeat-7.2.0 policy. This is because elastic create a template for this kind of logs automatically, what you have to do is delete this template, you can do this with the following command:

> DELETE \_template/metricbeat-7.2.0

If this work for you please choose one reply as the solution of this topic to help another people who need it.

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 13, 2019, 6:55am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/23 "2019-09-13T06:55:41Z")

</div>

> [@dgonzalezp](#):
>
> DELETE \_template/metricbeat-7.2.0

Thanks for your reply. I have the feeling that you are right.  
The metricbeat-7.2.0 policy was deleted. Let's see until tomorrow if the new metricbeat indexed go automatically to my default metricbeat\_policy.

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 13, 2019, 7:55am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/24 "2019-09-13T07:55:28Z")

</div>

Even if a new metricbeat will create it goes again to metricbeat-7.2.0 policy

You can check that the new metricbeat index that was created metricbeat-7.3.2-2019.09.13 has again as default policy the metricbeat-7.2.0

 ![3](https://us1.discourse-cdn.com/elastic/original/3X/3/5/3581ae540b99c336c8675b3c3735307de4cb2c0a.png)

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 13, 2019, 7:57am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/25 "2019-09-13T07:57:16Z")

</div>

In every new metricbeat index that is creating is creating by default this template  
metricbeat-7.2.0

---

<div class="post-metadata">

**Author:** ![dgonzalezp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dgonzalezp/32/50804_2.png) [@dgonzalezp](https://discuss.elastic.co/u/dgonzalezp)\
**Post date:** [September 16, 2019, 8:19am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/26 "2019-09-16T08:19:22Z")

</div>

Has been created again the metricbeat-7.2.0 template?

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 16, 2019, 11:33am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/27 "2019-09-16T11:33:28Z")

</div>

Yes in every new metricbeat index

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 16, 2019, 11:33am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/28 "2019-09-16T11:33:46Z")

</div>

Somewhere else must be this setting stored.

---

<div class="post-metadata">

**Author:** ![dgonzalezp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dgonzalezp/32/50804_2.png) [@dgonzalezp](https://discuss.elastic.co/u/dgonzalezp)\
**Post date:** [September 17, 2019, 9:18am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/29 "2019-09-17T09:18:34Z")

</div>

Hi again @antonopo  
I think that this setting is stored in the `metricbeat.yml` config file, if Im not wrong you have to set this parameter `setup.ilm.enabled: false`  
[https://www.elastic.co/guide/en/beats/metricbeat/current/ilm.html](https://www.elastic.co/guide/en/beats/metricbeat/current/ilm.html)

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 23, 2019, 11:51am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/30 "2019-09-23T11:51:14Z")

</div>

Yes you are right on this, i have set it to false.  
setup.ilm.enabled: false

Do i have to set it to true?

---

<div class="post-metadata">

**Author:** ![dgonzalezp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dgonzalezp/32/50804_2.png) [@dgonzalezp](https://discuss.elastic.co/u/dgonzalezp)\
**Post date:** [September 23, 2019, 2:04pm UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/31 "2019-09-23T14:04:37Z")

</div>

You have to set is to false, if you set it as false, the indexes from Metricbeat shouldnt be added to any ilm.

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 24, 2019, 8:51am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/32 "2019-09-24T08:51:42Z")

</div>

Hi again.

This option is already set to false to all my hosts

 ![5](https://us1.discourse-cdn.com/elastic/original/3X/8/9/8942381ccac8dbe2a1023006793b5a02deef2c7e.png)

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 24, 2019, 8:53am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/34 "2019-09-24T08:53:30Z")

</div>

```
###################### Metricbeat Configuration Example #######################

# This file is an example configuration file highlighting only the most common
# options. The metricbeat.reference.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/metricbeat/index.html

#========================== Modules configuration ============================

metricbeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
  #_source.enabled: false

#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:

# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
#fields:
# env: staging

#============================== Dashboards =====================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here or by using the `setup` command.
#setup.dashboards.enabled: false

# The URL from where to download the dashboards archive. By default this URL
# has a value which is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
   host: "atdevxhv03.emea.nsn-net.net:5601"
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  #host: "localhost:5601"

  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.
  #space.id:

#============================= Elastic Cloud ==================================

# These settings simplify using Metricbeat with the Elastic Cloud (https://cloud.elastic.co/).

# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.
#cloud.id:

# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
#cloud.auth:

#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]
   hosts: ["atdevxhv03.emea.nsn-net.net:9200", "it017060.it.alcatel-lucent.com:9200", "frelkxh01.fr.alcatel-lucent.com:9200", "atkvmxh01.emea.nsn-net.n
et:9200", "frkvmxh01.fr.alcatel-lucent.com:9200", "atdevxhv04.nsn-intra.net:9200", "itkvmxh01.emea.nsn-net.net:9200"]
  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
#output.logstash:
  # The Logstash hosts
  #hosts: ["localhost:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#================================ Processors =====================================

# Configure processors to enhance or manipulate events generated by the beat.

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]

#============================== Xpack Monitoring ===============================
# metricbeat can export internal metrics to a central Elasticsearch monitoring
# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
# reporting is disabled by default.

# Set to true to enable the monitoring reporter.
#monitoring.enabled: false

# Uncomment to send the metrics to Elasticsearch. Most settings from the
# Elasticsearch output are accepted here as well.
# Note that the settings should point to your Elasticsearch *monitoring* cluster.
# Any setting that is not set is automatically inherited from the Elasticsearch
# output configuration, so if you have the Elasticsearch output configured such
# that it is pointing to your Elasticsearch monitoring cluster, you can simply
# uncomment the following line.
#monitoring.elasticsearch:

#================================= Migration ==================================

# This allows to enable 6.7 migration aliases
#migration.6_to_7.enabled: true
setup.ilm.enabled: false
```

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [September 24, 2019, 8:53am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/35 "2019-09-24T08:53:44Z")

</div>

This is my metricbeat configuration

---

<div class="post-metadata">

**Author:** ![dgonzalezp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dgonzalezp/32/50804_2.png) [@dgonzalezp](https://discuss.elastic.co/u/dgonzalezp)\
**Post date:** [September 25, 2019, 8:53am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/36 "2019-09-25T08:53:16Z")

</div>

Try adding `setup.template.enabled: false`  
After this maybe you would have to make a filter in logstash to create a new index each day automatically

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [October 7, 2019, 7:42am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/37 "2019-10-07T07:42:53Z")

</div>

Hi again,

I have already this on my logstash configuration

```
[root@atdevxhv03 ~]# cat /etc/logstash/conf.d/30-elasticsearch-output.conf
output {
  elasticsearch {
    hosts => ["atdevxhv03.emea.nsn-net.net:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }

```

Metricbeat has as output the elasticsearch and not the logstash. Is this gonna work if i will do the change as you said having as output the elasticsearch?

---

<div class="post-metadata">

**Author:** ![dgonzalezp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dgonzalezp/32/50804_2.png) [@dgonzalezp](https://discuss.elastic.co/u/dgonzalezp)\
**Post date:** [October 7, 2019, 9:48am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/38 "2019-10-07T09:48:43Z")

</div>

Yes, should work anyway but maybe elastcisearch just create one index for all your logs from Metricbeat. Im not sure but you can try

---

<div class="post-metadata">

**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Post date:** [October 24, 2019, 7:46am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/39 "2019-10-24T07:46:57Z")

</div>

Hi again,

I tried this to heartbeat since i have the same problem like metricbeat. So no any new template were created but again is creating every time a new lifecycle policy

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2019, 7:47am UTC](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503/40 "2019-11-21T07:47:13Z")

</div>

Closed on November 21, 2019, 7:47am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/lifecycle-policy-configuration/198503.md?page=1)