Index Template Management for SO 2.4.20

[NexusChak]

The default SO index template (so-logs) has a priority of 225, which is higher than the Fortigate integration created template (with a priority 200), which means those Forigate indexes will only apply the "so-logs" template. This makes it difficult to manage and apply custom ILM policy.

I have tried setting the Fortigate template to a priority of 230, and removing the old data stream and all related indexes. New index and data stream with the correct Fortigate template is successfully created automatically. However, no document (log entry) could be written to the new index.

I thought of the Role privileges, but there is no difference in terms of the index pattern. I don't see any difference between index created by the "so-logs" template and the Fortigate template.