Send to different indices with filebeat modules and ILM enabled

[nber]

Hey there,

I'd like to collect logs on a device with different modules and send them to different indices.
The question itself is answered in:

Filebeat Apache Module Change Index Name

Hi @Ryne_Keel, If you want to use different indexes for different modules you can use the indices output setting. It allows you to configure different indices depending on some condition, for example you could do something like this in your case to have a different index for apache module: output.elasticsearch: hosts: ["elastic1:9200", "elastic2:9200"] indices: - index: "filebeat-%{[agent.version]}-apache-%{+yyyy.MM.dd}" when.equals: event.module: "apache" - default: …

Though, as far as I understand, this only works when ILM is disabled. Yet, I would like to keep ILM enabled on filebeat, to have the possibility to apply changes to the default index without touching/updating every device.
Now let's say I want syslog module logs in syslog index and nginx logs in ILM default index, e.g. filebeat-XYZ.

This is no problem for self defined inputs, yet, I can't figure out how to send logs collected by modules to different indices with ILM enabled.

Thanks and best regards,
Niklas