# Bootstrapped index is set as the write index but logs are getting written to old index

**URL:** <https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [September 30, 2021, 12:29pm UTC](https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589 "2021-09-30T12:29:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mitesh.gangaramani](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@mitesh.gangaramani](https://discuss.elastic.co/u/mitesh.gangaramani)\
**Post date:** [September 30, 2021, 12:29pm UTC](https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589/1 "2021-09-30T12:29:23Z")

</div>

Hello Experts,

We are running Elastic + Fluentbit + Kibana stack on kubernetes for container logs and it was working correctly with daily rollover based on date(new-YYYY-MM-DD) but on high volume  
it caused over shard size issue so created ILM policy mentioned below so that it can rollover quickly. Bootstrapped index is writable but still the old index of (new-YYYY-MM-DD) is getting written instead of the new index new-YYYY-MM-DD-000001. I have mentioned the things tried but no luck yet.

```auto
Created new policy with following condition:

PUT /_ilm/policy/new_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_age" : "10m" #just to test faster, actually want to set it to an hour.
          }
        }
      },
      "delete": {
        "min_age": "20d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

Created template:

PUT _template/new_template
{
  "index_patterns": ["new*"], 
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1,
    "index.lifecycle.name": "new_policy",
    "index.lifecycle.rollover_alias": "new-alias" 
  }
}

Bootstrapped new index which is creating and rolling over correctly.

PUT /%3Cnew-%7Bnow%2Fd%7D-000001%3E
{
  "aliases": {
    "new-alias":{
      "is_write_index": true 
    }
  }
}

Output plugin section inside fluentbit-configmap

[OUTPUT]
    Name es
    Match *
    Host ${FLUENT_ELASTICSEARCH_HOST}
    Port ${FLUENT_ELASTICSEARCH_PORT}
    HTTP_User ${FLUENT_ELASTICSEARCH_USER}
    HTTP_Passwd ${FLUENT_ELASTICSEARCH_PASSWORD}
    Logstash_Format On
    Logstash_Prefix new
    Trace_Error On
    Replace_Dots On
    Retry_Limit False
    tls On
    tls.verify Off

Tried indexing but no luck.

POST _reindex
{
  "source": {
    "index": "new-2021.09.30" 
  },
  "dest": {
    "index": "new-2021.09.30-000001", 
    "op_type": "create" 
  }
}

```

Also, tried creating entire new index-pattern but it seems coming from any system defaults and not making my ILM index as default for new logs.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 30, 2021, 10:55pm UTC](https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589/2 "2021-09-30T22:55:39Z")

</div>

I don't know fluentbit but I can't see any reference to the index in those output settings?

> [@mitesh.gangaramani](#):
>
> ```auto
> Tried indexing but no luck.
> 
> ```

What happens when you do that?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [October 1, 2021, 5:29am UTC](https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589/3 "2021-10-01T05:29:01Z")

</div>

Fluentbit need to be set up to write into the write alias and not a time based index pattern. Have never used fluentbit so do not know how to do this or whether it is possible.

---

<div class="post-metadata">

**Author:** ![mitesh.gangaramani](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@mitesh.gangaramani](https://discuss.elastic.co/u/mitesh.gangaramani)\
**Post date:** [October 1, 2021, 5:48am UTC](https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589/4 "2021-10-01T05:48:29Z")

</div>

> [@warkolm](#):
>
> What happens when you do that?

Yes. That issue is resolved now with the index parameter reference. I changed following parameters in output plugin to make it working.

```auto
        Logstash_Format Off
        #Logstash_Prefix new
        Index new-alias

```

---

<div class="post-metadata">

**Author:** ![mitesh.gangaramani](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@mitesh.gangaramani](https://discuss.elastic.co/u/mitesh.gangaramani)\
**Post date:** [October 1, 2021, 5:50am UTC](https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589/5 "2021-10-01T05:50:14Z")

</div>

Yes. exactly. The default timeseries reference was set which required to be changed to index alias.

Thank you guys for the inputs 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2021, 5:50am UTC](https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589/6 "2021-10-29T05:50:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.