Ok .. makes sense now. I dug a little based on this info. Looks like the ILM works fine, it does delete the index after the specified time. It seems my connector receives data for previous timestamp and thus a new index is created. I am good for now. Thanks for your quick response.