Hi, I have upgrade my stack from elk6.7.1 to elk7.9.1. In my stack index name are : logs-kelogs-pltf-YYYY.MM.dd.hh These indices are not managed by rollover and ilm policies. Logtash creates each hour a new index logs-kelogs-pltf-YYYY.MM.dd.hh History is managed by curator. My problem is that with elk7.9.1: 1 an ilm policy with rollover(logs) is set by default upon any index : logs-*-* with datastream. 2 my indexs logs-kelogs-pltf-YYYY.MM.dd.hh are not compliant with this policy, logstash fails trying to insert data in datastream like in .ds- logs-kelogs-pltf-YYYY.MM..dd.hh. I would avoid to use this ilm policy (or any ilm policy) for my indexs: logs-kelogs-pltf-YYYY.MM.dd.h I have try to modify the template `logs` to discard my indexs: ![image|690x189](upload://74e52IvquKgCm9Q2mvfBJ7qPlR7.png) ![image|690x121](upload://3iKtDKwwaXNxNs5audY0Ahq2tC0.png) But when I try to save the modification : save button turn round (saving label) Is there a simple way to avoid that logs ilm policy applies on my indexs Thanks
Finally , I create new index template (not legacy) overriding logs templtaes and it works (solved)
Thanks for sharing your solution.
FYI your first post is really hard to read with that formatting