Adding rollover configuration in ELK 7.6

Elastic Stack Elasticsearch
1

I am trying to rollover indices that are over 30 days and need to target indices that are already in the elasticsearch along with new indices
Our indices get created on weekly basis and i am not able to add an rollover alias to the indice.

Lifecycle policy for the index pattern below

{
  "index": {
    "lifecycle": {
      "name": "ilm-test",
      "rollover_alias": "rollover_infra"
    }
  }
}

Filebeat config:

setup.ilm.enabled: true
setup.template.enabled: true
setup.template.name: "inf"
setup.template.pattern: "001"
fields_under_root: true
index.lifecycle.rollover_alias: "rollover_infra"
aliases: "rollover_infra"
is_write_index: "true"

Error i get while using ilm explain

"reason" : "index.lifecycle.rollover_alias [rollover_infra] does not point to index [inf_ilm_test_logs-2021.08]",

2

Dear Atul,
please note that If index lifecycle management is enabled (which is typically the default), setup.template.name and setup.template.pattern are ignored.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.