Docs improvement for using ILM with Filebeat and Logstash

[schersh]

Issue posted in Slack by @DanRoscigno: Yesterday I asked about getting ILM going for logs from Filebeat and Logstash. Here are my notes (I got it going last night):

The ILM UI points to the API docs, probably it would be best to link to a page that walks through the UI, like this one, but that page really needs an intro that says “If you are using ILM with Beats or Logstash see the Beats docs or Logstash docs as both of these will set up ILM for you” (I don’t have links, I do not believe that the docs are merged yet, but the asciidoc is in GitHub.

For people not using Filbeat or Logstash 6.6, these are the steps to make it work (I think!):

• add attrs (e.g., node.attr.box_type: warm) to elasticsearch.yml to identify the nodes where warm and cold indices should be placed
• Have an index template for the data source that you want to use with ILM.
• Decide on the name for a rollover alias for the data source
• Create a lifecycle policy and associate the index template and rolover alias name from above
• Create an index with a rollover alias using the index template
• start sending in data

Where I got very confused was the create an index with a rollover alias step. I assumed that when I specified the index template and alias name that the index and alias were being created. Does the first index have to be created so that the alias will exist?

Here is a original video or smaller and public of what I did that worked out great.

I would be happy to help with doc updates if you like.

[DanRoscigno]

Here is the video referenced in the opening post for people who cannot access the original.