Apply Wazuh index policies to existing and future indices deliberately

Bottom line: Define the indices covered by a retention policy before enabling its deletion action. Keep automatic assignment to future indices separate from applying the policy to the existing population.

Source fact: documented behavior

The Index lifecycle management guide uses ISM policies to trigger index operations from conditions such as age, size and document count.

The retention procedure uses an ISM template and index pattern for automatic policy assignment to future alert indices.

It separately directs an operator to select existing indices and apply the policy to them, while the deletion example transitions on minimum index age.

What the source does not establish

This article plans policy assignment and an index-age deletion condition. It does not set a legal retention period, equate index age with every contained document’s age or approve deletion of any index merely because its name matches an example.

Applicability questions

• Which exact current and future index names belong to the approved population?
• What minimum index age and deletion authority are agreed?
• Which existing indices already have another policy?
• What recovery and observation plan is required before automation?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends reviewing existing-index attachment and future-index template coverage as separate acceptance lists before enabling deletion.

1. Prepare an index population worksheet containing the approved pattern, actual existing names and explicitly excluded controls. Obtain the data owner’s retention decision independently of the documentation’s example interval. Review whether the intended condition is expressed in index age. Keep exceptions and any separate document-level requirement visible instead of assuming that an index-level example satisfies every retention obligation.
2. Inspect the proposed template and the explicit existing-index attachment list together. Have another operator identify a future name that should match and one that must not. Review existing policy assignments before applying a new one. Do not treat creation of a policy definition as proof that either the old indices or tomorrow’s indices have the intended policy.
3. Rehearse on disposable indices with a deliberately limited population and approved test timing. Preserve the reviewed policy definition and recovery references before scheduling any production deletion. Name the owner who will inspect the assignment and state observations. Stop if the selected population differs from the worksheet rather than widening a pattern simply to make more indices appear managed.

Verification and evidence

Proposed verification: inspect an existing disposable index after explicit attachment, then create a separate approved test index for the future-template case. Record the actual policy assignment in both cases and verify that the excluded control remains outside the intended population. Keep these observations separate from a later transition or deletion result.

If a deletion rehearsal is authorized, retain the actual state, condition, operation and recovery observations for that disposable population. Do not invent a successful deletion or assume the policy acts at an exact wall-clock instant not established by the source. No index policy, live index or retention setting was changed for this article.

Official references

• Index lifecycle management — Wazuh; official product documentation.

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.