Customize data retention policies for integrations

These tutorials explain how to apply a custom ILM policy to an integration’s data stream.

For certain features you’ll need to use a slightly different procedure to manage the index lifecycle:

• APM: For versions 8.15 and later, refer to Index lifecycle management.
• Synthetic monitoring: Refer to Manage data retention.
• Universal Profiling: Refer to Universal Profiling index life cycle management.

How you apply an ILM policy depends on the data streams you want it to cover. Choose the approach that matches your use case.

• Apply an ILM policy to all data streams across all namespaces: Edit the logs@custom or metrics@custom component template, so the policy covers every Fleet logs-* or metrics-* data stream. Repeat separately for logs and for metrics.

• Apply an ILM policy to specific data streams across all namespaces: Edit a data stream's own @custom component template, leaving the integration's other data streams untouched.

• Apply an ILM policy to one data stream in one namespace: Clone the integration's index template and scope the copy to a single namespace. This is the heaviest option, because you take on maintaining the cloned template.

  Stack 9.5+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. For shared settings across every data stream in a namespace, refer to Customize data streams with namespace index templates.

• Stack 9.1+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Apply an ILM policy to all data streams in a custom integration: Create an <integration>@custom component template for an integration package you built yourself.