@ahmed_mansour5

Thanks a lot for the great explanation! It was really useful as it gave the two ways to deploy ILM (with and without rollover)

@tyserie9057

Love your work. Please keep them coming.

@Smaug1248

Nice video Clear sound. Thanks

@chikugerson5291

Great...you got yourself a subscriber 👏👏

@ihsanurrahman3348

i wish there were a like button which can generate tons of likes..i would do that on this video!! you have solve my biggest problem!!thanks a lot boss

@dipdiptortillachip

Great vids!

@miguelsaiz8151

Great Videos !

@hasanidriss1519

nice job man

@veyselyuksel1198

Hi, Thanks for sharing. But we use rollover mechanism for shard optimization and performance tuning. You said that logstash creates index  and you don't like pattern numbers :) But firewall-2022.11.08 index has static shard number. There are many shard limitations in elasticsearch. If you dont use them, your system is getting slower day by day.

@abdel8063

Thanks (y)

@SalmanIsha

index => firewall [ which you set as a rollover alias ] will write the data to 0001 and subsequent indexes that will be active on that particular moment.

@fabmartel

thanks, very good explain.  But plz reduce the size of webcam circle plzzzzz...and put right top... we dont see your windows console

@rahulsirugudi

I am using input beats, i have done exactly all the steps but the problem is after i start logstash i don't nothing coming to the index but i can see doc count and size are increasing but from discover i don't see any. Also it broke other indexes not sure what i missed.

@praveenkumar-uc3tu

I have a clarification, the same way we did for index gets created everyday also have created only life cycle with deletion of 30 days. Also have assigned same ILM assigned to index but it’s not automatically managed by index when the new index gets created. Please advise

@IvarsRuza

Nice vid! That Rollover is  for data streams  and be sure U set Your alias. Based on Your alias build dashboards, search quires, visualizations and never brake. With alias You target all Your indices with the same name. Data streams are great for managing, but for me somehow they are slow on warm on cold nodes. Data streams are like Timescale for Postgresql

@NikhilGoyal-g3l

Hi , I have a query If we are using Index with date and we need to apply Rollover in hot phase on that index. is it possible to apply or we can apply only delete phase ?

@AdolfoCuadra-tw7cn

Nice video! I am trying to create a rollover every week. I have created the template and policy just as you have. In the logstash.conf file, if I set ilm_pattern => “{now/day}-000001” just as you have , and the ilm policy max age to be 7 will the index rollover name be the date it is rolled over with the trailing 000001 or will the trailing numbers just keep incrementing when it rolls over and the date stays the same?

@mighnmagic9430

Can we remove from indice settings and template rolloover alias if we dont use rollover in firewall policy ?

@akshaysaini1613

Hi, please reply me 

I have trying so many time in ilm policy.. my elk version is 7.5.1 my indicis will move hot to warm. But in warm to cold it's not moving.even i have set min_age only 2m for translation warm to cold .....i have stuck this issue before a months please resolve it...and video on that like your indica will transfer all indicis