# Beat ILM Problems

**URL:** <https://discuss.elastic.co/t/beat-ilm-problems/218636>\
**Category:** Elasticsearch\
**Created:** [February 10, 2020, 4:32pm UTC](https://discuss.elastic.co/t/beat-ilm-problems/218636 "2020-02-10T16:32:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ali\_Szoenyi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ali_szoenyi/32/62376_2.png) [@Ali\_Szoenyi](https://discuss.elastic.co/u/Ali_Szoenyi)\
**Post date:** [February 10, 2020, 4:32pm UTC](https://discuss.elastic.co/t/beat-ilm-problems/218636/1 "2020-02-10T16:32:04Z")

</div>

Dear All.

I have following configuration.  
Elasticsearch Version 7.4.0

We have several beats in use.  
filebeat, metricbeat, packetbeat, auditbeat and heartbeat

We have following to communication streams from the beats to elasticsearch.

beat -\> elasticsearch

beat -\> logstash (with input beat port 5044 and output elasticsearch) -\> elasticsearch

logstash beat configuration:

# Beats -\> Logstash -\> Elasticsearch pipeline.

input {  
beats {  
port =\> 5044  
}  
}

output {  
elasticsearch {  
hosts =\> ["${ES\_HOSTS}"]  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
}  
}

The beats that are communicating direct to elasticsearch are writing their data into the

filebeat-7.4.0-YEAR.MONTH.DAY-000001  
metricbeat-7.4.0-YEAR.MONTH.DAY-000001  
packetbeat-7.4.0-YEAR.MONTH.DAY-000001  
auditbeat-7.4.0-YEAR.MONTH.DAY-000001  
heartbeat-7.4.0-YEAR.MONTH.DAY-000001

The beats that are communicating to logstash creating every day a new index

filebeat-7.4.0-YEAR.MONTH.DAY  
metricbeat-7.4.0-YEAR.MONTH.DAY  
packetbeat-7.4.0-YEAR.MONTH.DAY  
auditbeat-7.4.0-YEAR.MONTH.DAY  
heartbeat-7.4.0-YEAR.MONTH.DAY

I have following problems with the ILM

Index lifecycle error:  
illegal\_argument\_exception: index.lifecycle.rollover\_alias [filebeat-7.4.0] does not point to index [filebeat-7.4.0-2020.01.28]  
illegal\_argument\_exception: index.lifecycle.rollover\_alias [metricbeat-7.4.0] does not point to index [metricbeat-7.4.0-2020.01.27]  
illegal\_argument\_exception: index.lifecycle.rollover\_alias [packetbeat-7.4.0] does not point to index [packetbeat-7.4.0-2020.02.09]  
illegal\_argument\_exception: index.lifecycle.rollover\_alias [auditbeat-7.4.0] does not point to index [auditbeat-7.4.0-2020.01.31]  
illegal\_argument\_exception: index.lifecycle.rollover\_alias [heartbeat-7.4.0] does not point to index [heartbeat-7.4.0-2020.01.27]

I think this means that the beats that are communicationg over logstash are not able to use the Index Lifecycle Policies, because the indexes have not the extension -000001.

I will like to see that also the beats that are communicating over logstash are writing there data into the indexes with the extension -000001.

How can I fix this problem?

best regards  
Alexander

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2020, 4:32pm UTC](https://discuss.elastic.co/t/beat-ilm-problems/218636/2 "2020-03-09T16:32:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.