Unexpected behavior indexes

[devilman85]

I redid everything from 0 and it seems to work. The ilm of arkime_molochsession I linked it to the legacy template arkime_sessions3_template . Should I also link it to the malcolm_template template and the arkime_sessions3_esc_template template?

The indexes though are allocating to the nodes with the data role, but I gave the data_hot role with the molochtype hot attribute to a specific node to work only with Malcolm/arkime. In the index setting though, the tier is data_content.

[mmguero]

I am not an ILM expert, but I would guess you would probably want to do that. The malcolm_template is used for indexing zeek/suricata logs.

[devilman85]

I may have solved it. Tomorrow morning I will see the results

[devilman85]

I modified the template values. hope this will bring the desired results in the next few days