# Rolover policy for custom Index

**URL:** https://discuss.elastic.co/t/rolover-policy-for-custom-index/333399
**Category:** Elasticsearch
**Tags:** ilm-index-lifecycle-management
**Created:** [May 15, 2023, 4:02am UTC](https://discuss.elastic.co/t/rolover-policy-for-custom-index/333399 "2023-05-15T04:02:22Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![VellayLoket](https://avatars.discourse-cdn.com/v4/letter/v/13edae/32.png) [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)
#### Post date: [May 15, 2023, 4:02am UTC](https://discuss.elastic.co/t/rolover-policy-for-custom-index/333399/1 "2023-05-15T04:02:22Z")

</div>

I got logs from winlogbeats, and i want to store them in custom indexes.  
So i need rollover policy for this indexes.

here is part of logstash config file (output):

```auto
output {
  if [type] == "winlogbeat" {
		elasticsearch {
			hosts => ["https://10.101.8.48:9200"]
			user => "elastic"
			password => " *******"
			ssl => true
			ssl_certificate_verification => false
			cacert => "/etc/logstash/elasticsearch-ca.pem"
			index => "%{[@metadata][beat]}-%{+yyyyMMdd}"
			#ilm_rollover_alias => "winlogbeat"
			ilm_pattern => "000001"
			ilm_policy => "winlogbeat-policy"
		}
	}
	if [type] == "netflow" {
		elasticsearch {
			hosts => ["https://10.101.8.48:9200"]
			user => "elastic"
			password => " ********"
			ssl => true
			ssl_certificate_verification => false
			cacert => "/etc/logstash/elasticsearch-ca.pem"
			index => "netflow-%{+yyyyMMdd}"
			#ilm_rollover_alias => "netflow"
			ilm_pattern => "000001"
			ilm_policy => "netflow-policy"
		}
	}
  if [type] == "json" {
		elasticsearch {
			hosts => ["https://10.101.8.48:9200"]
			user => "elastic"
			password => " *******"
			ssl => true
			ssl_certificate_verification => false
		  cacert => "/etc/logstash/elasticsearch-ca.pem"
	  }
  }
	if [type] == "syslog" {
		elasticsearch {
			hosts => ["https://10.101.8.48:9200"]
			user => "elastic"
			password => " ****"
			ssl => true
			ssl_certificate_verification => false
			cacert => "/etc/logstash/elasticsearch-ca.pem"
	}
	#stdout { codec => rubydebug }
	}
}

```

Here is index-template settings:

```auto
{
  "index": {
    "lifecycle": {
      "name": "winlogbeat-policy",
      "rollover_alias": "winlogbeat"
    },
    "number_of_shards": "1",
    "refresh_interval": "5s"
  }
}

```

So this is how looks like indices now:

 ![indices](https://us1.discourse-cdn.com/elastic/original/3X/a/b/ab1b9870d5ef55e1a3ab50a2f5aa64a4cff231d1.png)

Can someone help to setup index-templates with rollover policy?

Elastic - v 7.15.2

---

<div class="post-metadata">

### Author: ![Alexis\_Roberson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexis_roberson/32/113233_2.png) [@Alexis\_Roberson](https://discuss.elastic.co/u/Alexis_Roberson)
#### Post date: [May 17, 2023, 7:12pm UTC](https://discuss.elastic.co/t/rolover-policy-for-custom-index/333399/2 "2023-05-17T19:12:44Z")

</div>

Are you wanting to define the mapping for the indices using the index template?

---

<div class="post-metadata">

### Author: ![VellayLoket](https://avatars.discourse-cdn.com/v4/letter/v/13edae/32.png) [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)
#### Post date: [May 25, 2023, 6:47am UTC](https://discuss.elastic.co/t/rolover-policy-for-custom-index/333399/3 "2023-05-25T06:47:08Z")

</div>

Had fix the problem by myself.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 22, 2023, 6:47am UTC](https://discuss.elastic.co/t/rolover-policy-for-custom-index/333399/4 "2023-06-22T06:47:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.