# Question about Elasticsearch ILM Index Lifecycle Policies **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [January 24, 2025, 9:18am UTC](https://discuss.elastic.co/t/question-about-elasticsearch-ilm-index-lifecycle-policies/373620 "2025-01-24T09:18:42Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ibollman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibollman/32/131438_2.png) [@ibollman](https://discuss.elastic.co/u/ibollman)\ **Post date:** [January 24, 2025, 9:18am UTC](https://discuss.elastic.co/t/question-about-elasticsearch-ilm-index-lifecycle-policies/373620/1 "2025-01-24T09:18:42Z")
Good Day! We have the following question about the ILMs: In our Elasticsearch Instance we are using the predefined default `logs`-ILM to manage our data streams. It is configured to delete the `logs-*` data streams after 90 days. So far so good everything works fine. Now we would like to keep the logs with the index pattern `logs-kubernetes.container_logs.eai-*` for 120 days. The problem is, that the logs ILM with the `logs-*` index pattern will delete all logs after 90 days anyway! So creating a new ILM just for `logs-kubernetes.container_logs.eai-*` to keep them for 120 won't work here - as I understand. Is there an easy way to solve this without creating ganular ILMs for every data stream separately? We have in total 70 data streams with the `logs-*` index pattern, that create huge amouts of data! We have updated to Elasticsearch 8.17 btw. Thank you kindly in advance! ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 24, 2025, 11:55am UTC](https://discuss.elastic.co/t/question-about-elasticsearch-ilm-index-lifecycle-policies/373620/2 "2025-01-24T11:55:06Z")
> [@ibollman](#): > > So creating a new ILM just for `logs-kubernetes.container_logs.eai-*` to keep them for 120 won't work here - as I understand. You need to create a different ILM policy for just the datastream of `logs-kubernetes.container_logs-*`. The steps to do it are in this [documentation](https://www.elastic.co/guide/en/fleet/current/data-streams-scenario2.html). Basically you will create your policy, then edit the `logs-kubernetes.container_logs@custom` component template and rollover your datastreams. This will be applied to every `logs-kubernetes.container_logs-*` datastream, independent of the namespace. ---
**Author:** ![ibollman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibollman/32/131438_2.png) [@ibollman](https://discuss.elastic.co/u/ibollman)\ **Post date:** [January 24, 2025, 3:50pm UTC](https://discuss.elastic.co/t/question-about-elasticsearch-ilm-index-lifecycle-policies/373620/3 "2025-01-24T15:50:24Z")
@leandrojmp YES, thank you, this is indeed exactly, what I need! I haven't used the right terms, so I haven't found this article 😵‍💫