Opensearch ILM/ISM issue

OpenSearch
1

Hi Team,

I have a question which I never found on guides,google or any websites :).

I installed filebeat and I see ilm is enabled by default. I think that’s why there is a default rollover rule. I think that beucase I see I have different indexes for each day. For example; filebeat-7.12.1-2023.01.06 filebeat-7.12.1-2023.01.07 filebeat-7.12.1-2023.01.08 etc. Even if ILM is enabled by default, I dont see and policy on opensearch dashboard. Probably if I use elastic search , I would see ILM default config.

I want to enable ISM instead of ILM.

These are my questions;
1- ILM is enabled by default in filebeat. How can I see default rule on opensearch dashboard?
2-If I disable ILM on filebeat config, how to confirm it works?
3-or any info or experiences which you have on this topic, I will glad to here.

Thanks in advance :slight_smile:

2

I assume Filebeat tries to enable an ILM policy, but that wouldn’t work in OpenSearch because there’s no ILM in OpenSearch (it’s only in Elasticsearch). So I think you can ignore the ILM stuff from Filebeat and just set up an ISM policy, then start indexing data.

3

Hi Radu,

Thanks for response. I think so but I see rollover policy for filebeat index. I see I have different indexes for each day. For example; filebeat-7.12.1-2023.01.06 filebeat-7.12.1-2023.01.07 filebeat-7.12.1-2023.01.08 etc.

If ILM is available for opensearch hot it rollover index. There is no ISM config as default.

How and where can I check default rollover rule ?

Thanks

4

Ah, I think that’s Filebeat’s default of writing events to an index that looks like:

filebeat-VERSION-YYY.MM.DD

Clarification: the above has nothing to do with ILM or ISM, it’s just a naming template.

To use ISM, you’ll need to change the index in Filebeat’s Elasticsearch output to something fixed, like “logs”. On the OpenSearch side, you’ll need a “logs” alias that will be managed by ISM.

5

Yes you’re. they are looking like filebeat-VERSION-YYY.MM.DD but I just did not understand why there are different index for each day. What cause to create different index for each day.

6

It’s because of the default setting for “index”: Configure the Elasticsearch output | Filebeat Reference [7.10] | Elastic

7

Hi Radu, I checked the link you shared but I did not understand which setting cause this rollover day by day. can you please share it directly :slight_smile: for example can ı change is as two days for rollover time no one day.