Kibana

After Kibana installation, we should do three things

1. Set up an index management policy.
2. Create an index template and associate the index management policy with it. Also enable data stream.
3. Create a data view in Kibana.

Data stream

Data stream allows controlling index size more precisely than date based index pattern. However, we need to be aware that the newest index belonging to a data stream will not be move from hot phase to warn phase as the index is not closed.

See more detail here https://discuss.elastic.co/t/index-rollover-not-working-after-reaching-maxday/309066/5

Basically, when using data stream, you should not use date based index pattern.