Need information on logs-endpoint.events.file@custom

Elastic Security Endpoint Security
1

Hi Experts,

I want to add warm phase under logs ILM policy ; However, editing elastic provided ILM or templates is not recommended. hence I analyzed the existing logs template set up to create new template and ILM for logs-endpoint.*.
While doing my analysis , I came across logs-endpoint.events.file@custom component template and I don't understand the purpose of having this template as it has no setting , mapping and alias.
Can someone please provide me more information on logs-endpoint.events.file@custom ? I searched on elastic site and could find it.
Thanks in advance!
Regards,
Nivedita

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.