Hi,
I have an Elasticsearch cluster that keeps logs from services within a year. I have also connected 30 elasticagents and logs from these agents exist on the cluster forever. During debug, I realize that data streams from agents are assigned to the "logs" ILM policy which keeps these logs in hot tier and does not delete old logs (By old logs i mean indices from elasticagents that existis on cluster more that one year).
I want to keep logs from elasticsearch agents from only one year also. So my question is it safe to modify this policy to store logs from only one year? I see that policy is managed by elasticsearch and `Managed policies are critical for internal operations.`
Thanks in advance.