We have filebeat OSS integrated with Open Distro Elasticsearch. We tested initially with Elasticsearch and filebeat with the following ILM policy (attached below).
However, now we want to integrate with filebeat OSS with AWS Elasticsearch which is Open Distro ES. We have “setup.ilm.enabled: false” and is working.
However, we want to enable the similar roll over policy using Index state management where new indexes are created when a size is reached or per day. We also want to delete logs indexes when they are 5 days old. Do you have any documentation that outlines how to do achieve this with Index state management and filebeat configuration?
ILM policy looks like this: policy": {
“phases”: {
“hot”: {
“actions”: {
“rollover”: {
“max_size”: “100GB” ,
“max_age”: “1d”
}
}
},
“delete”: {
“min_age”: “5d”,
“actions”: {
“delete”: {}
}
}
}
}
}