From 093bf8ccd867dd2d2f077ed993c2bba83ba3846a Mon Sep 17 00:00:00 2001 From: Ezequiel Klein <135483756+ezzprompt@users.noreply.github.com> Date: Wed, 26 Jun 2024 09:59:27 -0300 Subject: [PATCH] Update index-life-management.rst You should change the initial state on the policy because when you create the first state it defaults to this one that is the delete policy instead of the initial state. --- source/user-manual/wazuh-indexer/index-life-management.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/source/user-manual/wazuh-indexer/index-life-management.rst b/source/user-manual/wazuh-indexer/index-life-management.rst index 9f6cce619b..80c7cb2ed4 100644 --- a/source/user-manual/wazuh-indexer/index-life-management.rst +++ b/source/user-manual/wazuh-indexer/index-life-management.rst @@ -52,7 +52,9 @@ Using the Visual editor #. Choose **Add before** from the **Order** tab and select **delete_alerts**. #. Click **Add transition** and select **delete_alerts** as the **Destination state**. #. Select **Minimum Index Age** in **Condition**. Input the retention value, for example, **90d** for 90 days, in the **Minimum Index Age**. -#. Click **Add transition**. Click **Save state**. Click **Create**. +#. Click **Add transition**. Click **Save state**. +#. Click on the initial state dropdown and change to *initial*. +#. Click **Create**. Using the JSON editor ~~~~~~~~~~~~~~~~~~~~~ @@ -141,4 +143,4 @@ Applying the retention policy to alerts index :align: center :width: 80% -#. Select the policy created in the previous steps from the **Policy ID** menu. Click **Apply**. \ No newline at end of file +#. Select the policy created in the previous steps from the **Policy ID** menu. Click **Apply**.