So I was trying to change the index interval from daily to weekly when I first set it up hence the 2021.14 etc. Logstash sends it to elastic with a weekly naming number.
Output of GET _ilm/policy/winlogbeat:
{
"winlogbeat" : {
"version" : 2,
"modified_date" : "2021-03-31T16:08:21.398Z",
"policy" : {
"phases" : {
"hot" : {
"min_age" : "0ms",
"actions" : {
"rollover" : {
"max_size" : "50gb",
"max_age" : "30d"
}
}
},
"cold" : {
"min_age" : "90d",
"actions" : {
"set_priority" : {
"priority" : 0
}
}
}
}
}
}
}
And output of `GET _cat/shards/winlogbeat*?v:
index shard prirep state docs store ip node
winlogbeat-7.9.1-2021.14 0 p STARTED 361842642 169.4gb xxxxx elastic02
winlogbeat-7.9.1-2021.14 0 r STARTED 361842642 169.9gb xxxxx elastic01
winlogbeat-7.9.1-2009.53 0 r STARTED 73 108.7kb xxxxx elastic04
winlogbeat-7.9.1-2009.53 0 p STARTED 73 108.7kb xxxxx elastic01
winlogbeat-7.9.1-2021.11 0 p STARTED 11272 4.2mb xxxxx elastic03
winlogbeat-7.9.1-2021.11 0 r STARTED 11272 4.1mb xxxxx elastic08
winlogbeat-7.9.1-2021.13 0 p STARTED 16873905 7.8gb xxxxx elastic05
winlogbeat-7.9.1-2021.13 0 r STARTED 16873905 7.9gb xxxxx elastic07
winlogbeat-7.9.1-2021.12 0 p STARTED 118888 53.8mb xxxxx elastic03
winlogbeat-7.9.1-2021.12 0 r STARTED 118888 53.7mb xxxxx elastic01
I also plan on adding more storage down the road. I'm trying to clean up the config/get everything working as designed before I worry about the space requirements.