{
  "policy": {
    "policy_id": "stream-findings-policy",
    "description": "Findings retention. Structure copied from the Wazuh 5.0 beta documentation (user-manual/wazuh-indexer/wazuh-indexer-indices). Only min_index_age has been changed, from the documented default of 90d to 180d. Adjust min_index_age to set retention; leave the rollover block alone unless you have measured a reason to change it.",
    "default_state": "hot",
    "states": [
      {
        "name": "hot",
        "actions": [
          {
            "retry": {
              "count": 3,
              "backoff": "exponential",
              "delay": "1m"
            },
            "rollover": {
              "min_doc_count": 200000000,
              "min_primary_shard_size": "20gb"
            }
          }
        ],
        "transitions": [
          {
            "state_name": "delete",
            "conditions": {
              "min_index_age": "180d"
            }
          }
        ]
      },
      {
        "name": "delete",
        "actions": [
          {
            "retry": {
              "count": 3,
              "backoff": "exponential",
              "delay": "1m"
            },
            "delete": {}
          }
        ],
        "transitions": []
      }
    ],
    "ism_template": [
      {
        "index_patterns": [
          "wazuh-findings-v5-*"
        ],
        "priority": 1
      }
    ]
  }
}