Updating ILM / rollover aliases on existing {auditbeat, metricbeat, packetbeat ...} via API

[EricJohnson]

Greetings.

I'm interested in modifying the default ILM policy for all of my *beat processes using the API. We need to prevent hard drives from filling up - especially after version updates. We do not want to do this over Kibana because we will have many instances of ES running all over world and we need to automate the process.

I can successfully do it from scratch for a brand new index over the API. But if I try to apply a common scheme to all existing filebeat* indices it doesn't seem to pick up the update.

Steps...

I PUT the lifecycle policy in:

PUT /_ilm/policy/beat_default_lifecycle_policy
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_size": "5gb"
},
"set_priority": {
"priority": 100
}
}
},
"delete": {
"min_age": "7d",
"actions": {
"delete": {}
}
}
}
}
}

Then apply the policy to index patterns for filebeat*:

PUT _template/filebeat_rollover_template
{
"index_patterns": ["filebeat*"],
"settings": {
"number_of_shards": 1,
"number_of_replicas": 1,
"index.lifecycle.name": "beat_default_lifecycle_policy",
"index.lifecycle.rollover_alias": "filebeat"
}
}

The indices don't change their settings. Looking at the index filebeat-7.4.2-2019.12.02-000001
says:

"index.lifecycle.rollover_alias": "filebeat-7.4.2"

while the index filebeat-7.5.0-2019.12.03-000001 shows

"index.lifecycle.rollover_alias": "filebeat-7.5.0"

How can I successfully update all of these rollover_alias settings?

Thank you!

Eric

[EricJohnson]

Another way, perhaps, to ask this question is:

How can we change the ILM settings for our *beats by using only the API? That would work too.

Thanks again.

[EricJohnson]

See:

Solution