# Question about ILM
**URL:** https://discuss.elastic.co/t/question-about-ilm/249234
**Category:** Elasticsearch
**Tags:** ilm-index-lifecycle-management
**Created:** [September 20, 2020, 4:51am UTC](https://discuss.elastic.co/t/question-about-ilm/249234 "2020-09-20T04:51:00Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)
#### Post date: [September 20, 2020, 4:51am UTC](https://discuss.elastic.co/t/question-about-ilm/249234/1 "2020-09-20T04:51:00Z")
Hi,
I'm using a custom index in my filebeat so I had to disable ilm in elasticsearch.
My question is if there is a automatic solution to delete indices older than 3 months when ilm is diabled? or maybe have a hot-cold architecture?
My filebeat indices are created monthly.
---
### Author:  [@Emanuil](https://discuss.elastic.co/u/Emanuil)
#### Post date: [September 20, 2020, 9:41am UTC](https://discuss.elastic.co/t/question-about-ilm/249234/2 "2020-09-20T09:41:25Z")
Filebeat sets up ILM by default since 7.0 ([as per docs](https://www.elastic.co/guide/en/beats/filebeat/7.9/ilm.html)).
I think what you mean by
> I had to disable ilm in elasticsearch.
is that you're not using the _default_ ILM config from Filebeat and have set `setup.ilm.enabled: false` in your filebeat config. But ILM is not actually a Filebeat feature, it's an Elasticsearch general feature. You can configure ILM for any index or group of indices in Elasticsearch, including your custom index. Look at the [ILM feature docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html) rather than the Filebeat docs. You can set up a policy to delete indices after 90 days with ILM and apply it to your custom index.
If you share your filebeat config incl the custom index and the index name pattern it might be possible to help you more concretely.
---
### Author:  [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)
#### Post date: [September 20, 2020, 10:56am UTC](https://discuss.elastic.co/t/question-about-ilm/249234/3 "2020-09-20T10:56:40Z")
Hi Emanuil, thanks for your answer.
[Here](https://gist.githubusercontent.com/bornatalebi/05d59c06447bd32118a2beab864befa7/raw/a22c3e33313aad14178731dc31244dfa7a32e0cd/filebeat%2520configs) is my filebeat config.
> [@Emanuil](#):
>
> But ILM is not actually a Filebeat feature, it's an Elasticsearch general feature. You can configure ILM for any index or group of indices in Elasticsearch, including your custom index.
according to [documents](https://www.elastic.co/guide/en/beats/filebeat/7.8/elasticsearch-output.html#index-option-es) :
> Custom `index` settings are ignored when ILM is enabled.
so I stopped the ilm service using `POST _ilm/stop` because before this command I couldn't see my custom index (cisco beats) in the index management.
---
### Author:  [@Emanuil](https://discuss.elastic.co/u/Emanuil)
#### Post date: [September 21, 2020, 8:37am UTC](https://discuss.elastic.co/t/question-about-ilm/249234/4 "2020-09-21T08:37:03Z")
> [@borna\_talebi](#):
>
> Custom `index` settings are ignored when ILM is enabled.
Yes, _Filebeat_ ignores custom index settings when you turn on its ILM policy. But the ILM feature is much more general than how Filebeat uses it. That's why I directed you to the ILM feature docs as opposed to the Filebeat-with-ILM docs.
To apply an ILM policy to a series of indices, you ideally [use a policy template](https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-lifecycle-policy.html#apply-policy-template). The Kibana screenshot of creating such a template manually shows you it has an Index Settings step where you can supply your custom settings within an ILM policy. Just below the screenshot the doc links to the [PUT policy template API doc](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-template.html#put-index-template-api-request-body). The `template` object contains a `settings` object which allows any custom index setting.
> `settings` (Optional, [index setting object](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html#index-modules-settings)) Configuration options for the index. See [Index Settings](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html#index-modules-settings).
So, try setting up an ILM policy yourself and applying it to your custom index. Set `setup.ilm.enabled: false` in your Filebeat config to prevent it from using its own ILM policies.
EDIT: Between Filebeat's use of ILM and the general ILM feature this is a bit complicated. If you post you custom index settings here I'll show you how to define an ILM policy to "delete data after 3 months" as per your original post, and you can then customise it further when you confirm it works.
---
### Author:  [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)
#### Post date: [September 21, 2020, 9:05am UTC](https://discuss.elastic.co/t/question-about-ilm/249234/5 "2020-09-21T09:05:44Z")
> [@Emanuil](#):
>
> Yes, _Filebeat_ ignores custom index settings when you turn on its ILM policy. But the ILM feature is much more general than how Filebeat uses it.
So if I just set` setup.ilm.enabled: false` i can use general ILM feature for other indices including my custom filebeat index, correct?
> [@Emanuil](#):
>
> f you post you custom index settings here I'll show you how to define an ILM policy to "delete data after 3 months" as per your original post,
Thanks but I think by following the docs I can configure it myself.
---
### Author:  [@Emanuil](https://discuss.elastic.co/u/Emanuil)
#### Post date: [September 21, 2020, 9:12am UTC](https://discuss.elastic.co/t/question-about-ilm/249234/6 "2020-09-21T09:12:52Z")
> [@borna\_talebi](#):
>
> So if I just set ` setup.ilm.enabled: false` i can use general ILM feature for other indices including my custom filebeat index, correct?
You can always use the general ILM feature on other indices as long as you don't disable it via other means like `_ilm/stop` - even while Filebeat is using ILM. `setup.ilm.enabled: false` tells Filebeat not to use ILM which you need for your specific use case. By applying it, you can [start ILM again](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-start.html), so you can then use it for a custom policy.
---
### Author:  [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)
#### Post date: [September 21, 2020, 9:17am UTC](https://discuss.elastic.co/t/question-about-ilm/249234/7 "2020-09-21T09:17:17Z")
Thanks a lot for your detailed responses.
_Best regards,_
_borna_
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 19, 2020, 9:17am UTC](https://discuss.elastic.co/t/question-about-ilm/249234/8 "2020-10-19T09:17:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.