Using a single Life Cycle Policy for many Index Templates

dturner
Tue, 02 Aug 2022 17:26:09 +0000
Elasticsearch

Hello,

We are using Elastic agent with different policies for different integrations. This has created many index templates for these different data sources. Each one of these index templates is using a different index lifecycle policy. Instead of managing dozens of lifecycle policies, we would like to point the existing index templates to one of our custom index lifecycle policies. We would also like any new data source to use one of our custom index lifecycle policies. How can this be done? Is there a better way than manually adding each individual index template to a lifecycle policy?

I have added the primary logs index template ( logs--) to our custom lifecycle policy, however, this does not apply to all indicies as many are explicitly looking for an individual index source like
logs-cisco_ftd.log-* or logs-elastic_agent-*.

Thank you for your help!
Derrick

6 posts - 3 participants