Hello,
I can't import the older logs into elasticsearch even though the following options have been specified into winlogbeat.yml.
winlogbeat.event_logs:
- name: Application
ignore_older: 720h
- name: System
ignore_older: 720h
- name: Security
ignore_older: 720h
tags: ["security", "elastic1"]
winlogbeat.shutdown_timeout: 30s
The ILM settings are shown below:
# ILM and template settings
setup.template.overwrite: true
setup.ilm.enabled: true
setup.ilm.rollover_alias: "elastic1"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.policy_file: "ilm_policy.json"
setup.ilm.policy_name: "elastic1"
setup.ilm.overwrite: true
ilm_policy.json
{
"policy": {
"phases": {
"hot": {
"actions": {
"rollover": {
"max_age": "7d",
"max_size": "10G"
}
}
},
"warm": {
"min_age": "7d",
"actions": {
"forcemerge": {
"max_num_segments": 6
},
"shrink": {
"number_of_shards": 6
},
"allocate": {
"number_of_replicas": 1
}
}
},
"cold": {
"min_age": "30d",
"actions": {
"allocate": {
"require": {
"type": "cold"
}
}
}
},
"delete": {
"min_age": "90d",
"actions": {
"delete": {}
}
}
}
}
}