Disable ILM on ELK vendor yaml

ILM is enabled by default in 7.6.2
and WAF statistics is expecting daily
indices.

changelogs/unreleased/disable_ilm_on_ELK_yaml.yml

+---
+title: Disable ILM on ELK vendor yaml
+merge_request: 35398
+author:
+type: fixed

spec/models/clusters/applications/elastic_stack_spec.rb

@@ -27,6 +27,20 @@ RSpec.describe Clusters::Applications::ElasticStack do
       expect(subject.preinstall).to be_empty
     end
 
+    context 'within values.yaml' do
+      let(:values_yaml_content) {subject.files[:"values.yaml"]}
+
+      it 'contains the disabled index lifecycle management' do
+        expect(values_yaml_content).to include "setup.ilm.enabled: false"
+      end
+
+      it 'contains daily indices with respective template' do
+        expect(values_yaml_content).to include "index: \"filebeat-%{[agent.version]}-%{+yyyy.MM.dd}\""
+        expect(values_yaml_content).to include "setup.template.name: 'filebeat'"
+        expect(values_yaml_content).to include "setup.template.pattern: 'filebeat-*'"
+      end
+    end
+
     context 'on a non rbac enabled cluster' do
       before do
         elastic_stack.cluster.platform_kubernetes.abac!

vendor/elastic_stack/values.yaml

@@ -14,8 +14,12 @@ filebeat:
   filebeatConfig:
     filebeat.yml: |
       output.file.enabled: false
+      setup.ilm.enabled: false
+      setup.template.name: 'filebeat'
+      setup.template.pattern: 'filebeat-*'
       output.elasticsearch:
         hosts: ["http://elastic-stack-elasticsearch-master:9200"]
+        index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
       filebeat.inputs:
       - type: container
         paths: