# Alias creation

**URL:** <https://discuss.elastic.co/t/alias-creation/332273>\
**Category:** Elasticsearch\
**Tags:** docker, ilm-index-lifecycle-management\
**Created:** [May 2, 2023, 12:31pm UTC](https://discuss.elastic.co/t/alias-creation/332273 "2023-05-02T12:31:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebinnsebastiann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebinnsebastiann/32/120522_2.png) [@sebinnsebastiann](https://discuss.elastic.co/u/sebinnsebastiann)\
**Post date:** [May 2, 2023, 12:31pm UTC](https://discuss.elastic.co/t/alias-creation/332273/1 "2023-05-02T12:31:34Z")

</div>

I deployed efk-8.7.0 using kubernetes.

> elasticsearch: [docker.elastic.co/elasticsearch/elasticsearch:8.7.0](http://docker.elastic.co/elasticsearch/elasticsearch:8.7.0)  
> kibana: [docker.elastic.co/kibana/kibana:8.7.0](http://docker.elastic.co/kibana/kibana:8.7.0)  
> fluentbit: fluent/fluent-bit:2.1.1

Everyday logs are created like this,

`logstash-yyyy.mm.dd`

I created lifecycle ploicy and index template.

But whenever rollover is performed then we get the errors like,

`illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [logstash-2023.04.25] is empty or not defined`

So I added the rollover alias, then I got error like,

`illegal_argument_exception: rollover target [efk-8.7.0] does not point to a write index`

I tried to create a write index by,

```auto
curl -X PUT "localhost:9200/%3Cmy-index-%7Bnow%2Fd%7D-000001%3E?pretty" -H 'Content-Type: application/json' -d'
{
  "aliases": {
    "efk": {
      "is_write_index": true
    }
  }
}
'

```

But it just creates a new index. New data is not writing to it. It still writes the data in same format "logstash-yyyy.mm.dd".

Any Idea how to set up alias for bootstrap index ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 2, 2023, 11:52pm UTC](https://discuss.elastic.co/t/alias-creation/332273/2 "2023-05-02T23:52:04Z")

</div>

Welcome to our community! 😃

> [@sebinnsebastiann](#):
>
> Everyday logs are created like this,
> 
> `logstash-yyyy.mm.dd`

Generally you don't do this, and let ILM manage the index names.

Are you sending data to Logstash? If not why are you using that in the index name, and what is sending the data to Elasticsearch and using that as the index name?

---

<div class="post-metadata">

**Author:** ![sebinnsebastiann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebinnsebastiann/32/120522_2.png) [@sebinnsebastiann](https://discuss.elastic.co/u/sebinnsebastiann)\
**Post date:** [May 3, 2023, 4:57am UTC](https://discuss.elastic.co/t/alias-creation/332273/3 "2023-05-03T04:57:33Z")

</div>

fluentbit is sending logs to Elasticsearch. fluentbit configmap is given below,

```auto
apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: kube-logging
  labels:
    k8s-app: fluent-bit
data:
  # Configuration files: server, input, filters and output
  # ======================================================
  fluent-bit.conf: |
    [SERVICE]
        Flush 1
        Log_Level info
        Daemon off
        Parsers_File parsers.conf
        HTTP_Server On
        HTTP_Listen 0.0.0.0
        HTTP_Port 2020

    @INCLUDE input-kubernetes.conf
    @INCLUDE filter-kubernetes.conf
    @INCLUDE output-elasticsearch.conf

  input-kubernetes.conf: |
    [INPUT]
        Name tail
        Tag kube.*
        Path /var/log/containers/*.log
        Parser docker
        DB /var/log/flb_kube.db
        Mem_Buf_Limit 5MB
        Skip_Long_Lines On
        Refresh_Interval 10

  filter-kubernetes.conf: |
    [FILTER]
        Name kubernetes
        Match kube.*
        Kube_URL https://kubernetes.default.svc:443
        Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix kube.var.log.containers.
        Merge_Log On
        Merge_Log_Key log_processed
        K8S-Logging.Parser On
        K8S-Logging.Exclude Off

  output-elasticsearch.conf: |
    [OUTPUT]
        Name es
        Match *
        Host ${FLUENT_ELASTICSEARCH_HOST}
        Port ${FLUENT_ELASTICSEARCH_PORT}
        HTTP_User ${FLUENT_ELASTICSEARCH_USER}
        HTTP_Passwd ${FLUENT_ELASTICSEARCH_PASSWORD}
        Logstash_Format On
        Replace_Dots On
        Retry_Limit False
        Suppress_Type_Name On

  parsers.conf: |
    [PARSER]
        Name apache
        Format regex
        Regex ^(?<host>[^]*) [^]* (?<user>[^]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^]*) (?<size>[^]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
        Time_Key time
        Time_Format %d/%b/%Y:%H:%M:%S %z

    [PARSER]
        Name apache2
        Format regex
        Regex ^(?<host>[^]*) [^]* (?<user>[^]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^]*) +\S*)?" (?<code>[^]*) (?<size>[^]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
        Time_Key time
        Time_Format %d/%b/%Y:%H:%M:%S %z

    [PARSER]
        Name apache_error
        Format regex
        Regex ^\[[^]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$

    [PARSER]
        Name nginx
        Format regex
        Regex ^(?<remote>[^]*) (?<host>[^]*) (?<user>[^]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^]*) (?<size>[^]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
        Time_Key time
        Time_Format %d/%b/%Y:%H:%M:%S %z

    [PARSER]
        Name json
        Format json
        Time_Key time
        Time_Format %d/%b/%Y:%H:%M:%S %z

    [PARSER]
        Name docker
        Format json
        Time_Key time
        Time_Format %Y-%m-%dT%H:%M:%S.%L
        Time_Keep On

    [PARSER]
        # http://rubular.com/r/tjUt3Awgg4
        Name cri
        Format regex
        Regex ^(?<time>[^]+) (?<stream>stdout|stderr) (?<logtag>[^]*) (?<message>.*)$
        Time_Key time
        Time_Format %Y-%m-%dT%H:%M:%S.%L%z

    [PARSER]
        Name syslog
        Format regex
        Regex ^\<(?<pri>[0-9]+)\>(?<time>[^]* {1,2}[^]* [^]*) (?<host>[^]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$
        Time_Key time
        Time_Format %b %d %H:%M:%S

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 3, 2023, 5:52am UTC](https://discuss.elastic.co/t/alias-creation/332273/4 "2023-05-03T05:52:56Z")

</div>

It looks like Fluentbit is writing to the indexnaming pattern you showed. This is incompatible with rollover.

In order to use rollover you would need to create a rollover index from scratch and then make Fluentbit write to the write alias and not a index name pattern that contains the date. As Fluentbit is not supported here I do not know how to configure this in Fluentbit or whether it is actually possible. You will need to reach out to the Fluentbit community for advice about that.

Having said that you should be able to manage index retention of the indices that are currently created using ILM, but this assumes you are not using rollover.

---

<div class="post-metadata">

**Author:** ![sebinnsebastiann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebinnsebastiann/32/120522_2.png) [@sebinnsebastiann](https://discuss.elastic.co/u/sebinnsebastiann)\
**Post date:** [May 8, 2023, 8:55am UTC](https://discuss.elastic.co/t/alias-creation/332273/5 "2023-05-08T08:55:08Z")

</div>

I was able to resolve this issue.

Refer this,

[https://github.com/fluent/fluent-bit/issues/1670#issuecomment-1087250426](https://github.com/fluent/fluent-bit/issues/1670#issuecomment-1087250426)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2023, 8:55am UTC](https://discuss.elastic.co/t/alias-creation/332273/6 "2023-06-05T08:55:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.