Packetbeat, fail to set up index lifecyle policy

Elastic Stack Beats
1

Hi Community,

I have tried to set up packetbeat index for 2 days, then rollover to delete phrase for 1 day. I have 1 node, for practice only.

This was my configuration in packetbeat.yml where I made changes, others remained as default. (Of course, I connected to ES and Kibana).

conf1
conf1975×172 49.5 KB

image

From kibana API, I created index lifecycle policy "p1" (10G, 2 days, hot phase; then delete phase) and linked to index template "packetbeat - 7.9.3"
image

but I noticed that "phase definition" still shows 50G, 30 days as default:
image
image

And after two days, I found that "p1" was modified to 50G, 30 days automatically, packetbeat index which started 2 days was deleted and now it starts a packetbeat index with all default settings, no lifecycle policy attached.

What was wrong? How can I set up a correct lifecycle?

Many many thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.