NSM logs size & indices

[mahmoudelhaj]

I am trying to limit the /nsm size, but doesn't working
I create lifecycle policy, but it doesn't seem to work, how do I check it?
my hot phase -> maximum size 50 giga & maximum age 30 days
warm phase -> 5 days
Cold phase -> 5 days
Delete phase -> 5 days

Another question, why my indices look like that?

[mahmoudelhaj]

Index lifecycle policies apply to index templates

[cm-ops]

Would you provide some more information about you grid #1720?

[mahmoudelhaj]

1. can limit nsm logs size using lifecycle management ??
2. my indices should look like so-firewall-3-3-2023 ?? Why do they appear differently ??
   

[cm-ops]

1. https://docs.securityonion.net/en/latest/curator.html?curator-vs-index-lifecycle-management-ilm#curator-vs-index-lifecycle-management-ilm We use Curator to manage the indices to ensure you don't run out of disk space.
2. You are looking at the raw data on disk. If you use the REST API to query the indices you will see so-firewall-* you can use the so-elasticsearch-query _cat/indices command to see them in the so-* list.