# Wazuh template ILM policy resets to blank post-upgrade to 4.4.4

**URL:** <https://discuss.elastic.co/t/wazuh-template-ilm-policy-resets-to-blank-post-upgrade-to-4-4-4/340260>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [August 7, 2023, 10:48am UTC](https://discuss.elastic.co/t/wazuh-template-ilm-policy-resets-to-blank-post-upgrade-to-4-4-4/340260 "2023-08-07T10:48:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nightingale\_John](https://avatars.discourse-cdn.com/v4/letter/n/ecccb3/32.png) [@Nightingale\_John](https://discuss.elastic.co/u/Nightingale_John)\
**Post date:** [August 7, 2023, 10:48am UTC](https://discuss.elastic.co/t/wazuh-template-ilm-policy-resets-to-blank-post-upgrade-to-4-4-4/340260/1 "2023-08-07T10:48:42Z")

</div>

Hi,

I use Wazuh with Elastic, and recently I performed an update of wazuh to 4.4.4. Since the upgrade the ILM policy on the Wazuh template reset to null and therefore indexes didn't roll over.

I thought i fixed the index template:

```auto
PUT _template/wazuh
{
  "index_patterns": ["wazuh-alerts-4.x-*"],
  "settings": {
    "index.lifecycle.name": "wazuh",
    "index.lifecycle.rollover_alias" : "wazuh-alerts-4.x"
  }
}

```

This managed to fix it temporarily, but then the index didnt roll over again, and checking the index template the ILM policy is blank again. Putting it back using the above code worked, but then i saw within 10 mins the policy was reset to blank again.

Any ideas?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 7, 2023, 2:35pm UTC](https://discuss.elastic.co/t/wazuh-template-ilm-policy-resets-to-blank-post-upgrade-to-4-4-4/340260/2 "2023-08-07T14:35:51Z")

</div>

> [@Nightingale\_John](#):
>
> This managed to fix it temporarily, but then the index didnt roll over again, and checking the index template the ILM policy is blank again. Putting it back using the above code worked, but then i saw within 10 mins the policy was reset to blank again.

You need to edit the source json template file for wazuh, if you are using filebeat it will overwrite the template you have.

---

<div class="post-metadata">

**Author:** ![Nightingale\_John](https://avatars.discourse-cdn.com/v4/letter/n/ecccb3/32.png) [@Nightingale\_John](https://discuss.elastic.co/u/Nightingale_John)\
**Post date:** [August 7, 2023, 2:39pm UTC](https://discuss.elastic.co/t/wazuh-template-ilm-policy-resets-to-blank-post-upgrade-to-4-4-4/340260/3 "2023-08-07T14:39:58Z")

</div>

Ah thanks Leandro!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2023, 2:40pm UTC](https://discuss.elastic.co/t/wazuh-template-ilm-policy-resets-to-blank-post-upgrade-to-4-4-4/340260/4 "2023-09-04T14:40:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.