Index Policy - Cold Storage

[Sam Heuchert]

Hi!

I'm looking to find the best practice for applying index policies to indices older than 14 days.  I attempted to configure the following, but it did not work.  I'm running a distributed cluster with ample resources.  

Thanks!

Sam

[Damian Nicastro]

Hello  sheuchert:

I hope you are fine.

In order to implement Index policies, we recommend you read carefully and follow the document below:

Wazuh index management · Wazuh · The Open Source Security Platform

Here, you have a brief explanation of the diffrent phases where you can put your Indices. Please, also notice that the first half of the document is Elastic Stack ILM policies while the part starting with "Opendistro ISM" is for Opendistro and Opensearch installations.

I hope this helps.

Thanks