# Logs from elasticsearch agents

**URL:** <https://discuss.elastic.co/t/logs-from-elasticsearch-agents/384361>\
**Category:** Elastic Agent\
**Created:** [January 5, 2026, 11:29am UTC](https://discuss.elastic.co/t/logs-from-elasticsearch-agents/384361 "2026-01-05T11:29:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJ](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@TheJ](https://discuss.elastic.co/u/TheJ)\
**Post date:** [January 5, 2026, 11:29am UTC](https://discuss.elastic.co/t/logs-from-elasticsearch-agents/384361/1 "2026-01-05T11:29:19Z")

</div>

Hi,

I have an Elasticsearch cluster that keeps logs from services within a year. I have also connected 30 elasticagents and logs from these agents exist on the cluster forever. During debug, I realize that data streams from agents are assigned to the **"logs" ILM policy** which keeps these logs in hot tier and does not delete old logs (By old logs i mean indices from elasticagents that existis on cluster more that one year).

_ **I want to keep logs from elasticsearch agents from only one year also. So my question is it safe to modify this policy to store logs from only one year?** _ I see that policy is managed by elasticsearch and `Managed policies are critical for internal operations.`

Thanks in advance.