# Logstash + datastreams

**URL:** <https://discuss.elastic.co/t/logstash-datastreams/315210>\
**Category:** Elasticsearch\
**Created:** [September 26, 2022, 7:33pm UTC](https://discuss.elastic.co/t/logstash-datastreams/315210 "2022-09-26T19:33:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zdeno\_Liska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zdeno_liska/32/83511_2.png) [@Zdeno\_Liska](https://discuss.elastic.co/u/Zdeno_Liska)\
**Post date:** [September 26, 2022, 7:33pm UTC](https://discuss.elastic.co/t/logstash-datastreams/315210/1 "2022-09-26T19:33:46Z")

</div>

Hi, I have issue with configuration of Logstash and Datastreams with already defined ILM,index template  
here are details:

Logstash pipeline config:

```auto
elasticsearch {
      hosts => ["host1"]
      data_stream => "true"
      data_stream_type => "metrics"
      data_stream_dataset => "factory_data"
      data_stream_namespace => "init_cycle_readings"
      user => logstash_internal
      password => pass001
      ssl => true
      cacert => '/etc/logstash/elasticsearch-ca.pem'
    }

```

than index template:

index pattern: metrics-factory\_data-\*

```auto
{
  "index": {
    "lifecycle": {
      "name": "metrics-factory_data-init_cycle_readings_policy"
    },
    "number_of_shards": "3",
    "number_of_replicas": "1"
  }
}

```

anyway, I can see that metrics template is applied with index shards =1

Can you give me advice how to make logstash working with custom ILM, index template and datastream? Or should I return back to index definition in logstash output and forget about datastrrams?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2022, 7:34pm UTC](https://discuss.elastic.co/t/logstash-datastreams/315210/2 "2022-10-24T19:34:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.