Arkime generates "legacy index templates" which are "deprecated in favor of composable index templates"

[devilman85]

Legacy index templates are not compatible with ILM in the new Elasticsearch clusters (version 8.x).One would migrate the arkime_sessions3_template to a composable index template, which is the required format to automatically apply an ILM policy to the new indexes.

[mmguero]

I'm confused as to why you logged this, because Malcolm already uses composable index template for for this index template.

[devilman85]

i'm not talking about the malcolm index but what arkime generates via ilm. this is what i have in my elasticsearch

[mmguero]

Hmmm, okay. This is an upstream issue with Arkime, then. I'll follow up with the Arkime devs about it.