With #81744 we introduced new default templates for Metricbeat which are installed at cluster start up. These new templates make use of the data streams features, which means that the indices they create are not subject to the cleaner service that is present in the monitoring plugin.

As such, these templates will likely require an ILM policy to be deployed with them to clean up the older indices over time.

Furthermore, since these resources will be data stream oriented, the ILM policy will likely be needed to roll over the data streams. The current format for the matching pattern on the template includes a wildcard at the end of the data stream name. We should ensure that this wildcard is not being used for dates. The process for creating new backing indices should be managed by the data stream rollover functionality instead of using new names.

==
EDIT: Summary of planned change for retention of stack monitoring data with Metricbeat 8.0

• Stop using the legacy Cleaner service
• Use the ILM policy below [1] that will ship by default and be associated via the stack monitoring index templates
• The ILM policy is essentially a 3-6 day default (it is not expected to ever hit the 50gb size)
• The ILM policy will rollover every 3 days and move it to the warm tier (if it exists), force merge the index, then wait 3 more days till it is deleted.
• We will carry forward the xpack.monitoring.history.duration if it was set in a prior version for use as the min_age for delete
• Ideally this ILM policy will be presented as the default ILM policy for the Fleet stack monitoring integrations.
• Normal ILM tooling can be used to control retention and behavior.

[1]

{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_primary_shard_size": "50gb",
            "max_age": "3d"
          }
        }
      },
      "warm": {
        "actions": {
          "forcemerge": {
            "max_num_segments": 1
          }
        }
      },
      "delete": {
        "min_age": "<VALUE_TO_BE_SET_FROM_xpack.monitoring.history.duration_OR_3_DAYS_IF_UNCONFIGURED>",
        "actions":{
          "delete": {}
        }
      }
    }
  }
}