Cannot find write index

Elastic Stack Elasticsearch
1

Getting below error
policy [ilm_cedar] for index [cedar-00001] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step
java.lang.IllegalArgumentException: rollover target [cedar_log] does not point to a write index

The bootstrap command gives bad request error.
PUT cedar-00001
{
"aliases": {
"cedar_log": {
"is_write_index": true
}
}
}

The Output
{
"error": {
"root_cause": [
{
"type": "resource_already_exists_exception",
"reason": "index [cedar-00001/Ee4slVvzTku_EgbW17yU-g] already exists",
"index_uuid": "Ee4slVvzTku_EgbW17yU-g",
"index": "cedar-00001"
}
],
"type": "resource_already_exists_exception",
"reason": "index [cedar-00001/Ee4slVvzTku_EgbW17yU-g] already exists",
"index_uuid": "Ee4slVvzTku_EgbW17yU-g",
"index": "cedar-00001"
},
"status": 400
}
Can anyone guide me?

2

Welcome!

Please read this about how to format.

You need to use the update settings API and not the create index if your index already exists I guess.

PUT /cedar-00001/_settings
{
  "aliases" : {
    "cedar_log" : {
      "is_write_index": true
    }
  }
}

But I don't know if this is what you really want to do...

3

Hi @dadoonet , I have index created through logstash. I want to apply lifecycle policy to it to retain logs for 3 days. For testing purpose i have created this policy.

"ilm_cedar": {
    "version": 2,
    "modified_date": "2023-05-30T10:20:34.684Z",
    "policy": {
      "phases": {
        "hot": {
          "min_age": "0ms",
          "actions": {
            "set_priority": {
              "priority": 100
            },
            "rollover": {
              "max_age": "55s"
            }
          }
        },
        "delete": {
          "min_age": "1m",
          "actions": {
            "delete": {
              "delete_searchable_snapshot": true
            }
          }
        }
      }
    },
    "in_use_by": {
      "indices": [],
      "data_streams": [],
      "composable_templates": [
        "cedar_template",
        "cedar_log_temp"
      ]
    }
  },

I'm using index template to apply the policy to the index.

{
  "index_templates": [
    {
      "name": "cedar_log_temp",
      "index_template": {
        "index_patterns": [
          "cedar-*"
        ],
        "template": {
          "settings": {
            "index": {
              "lifecycle": {
                "name": "ilm_cedar",
                "rollover_alias": "cedar_log"
              },
              "number_of_shards": "1",
              "number_of_replicas": "1"
            }
          }
        },
        "composed_of": []
      }
    }
  ]
}

I'm getting the error
policy [ilm_cedar] for index [cedar-00001] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step
java.lang.IllegalArgumentException: rollover target [cedar_log] does not point to a write index.

I tried the update settings API from your response but getting this error. FYI, im using BASIC license.

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "unknown setting [index.aliases.cedar_log.is_write_index] please check that any required plugins are installed, or check the breaking changes documentation for removed settings"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "unknown setting [index.aliases.cedar_log.is_write_index] please check that any required plugins are installed, or check the breaking changes documentation for removed settings"
  },
  "status": 400
}
4

As it's a test, I'd run:

DELETE /cedar-00001
PUT /cedar-00001
{
  "aliases" : {
    "cedar-log" : {
      "is_write_index": true
    }
  }
}

Note that I'm using cedar-log instead of cedar_log. Note sure it's important but this is what I can see from the doc :wink: .

5

According to the document, we don't need to bootstrap an index from beats and logstash. I ran the code you sent and got this

{
  "error": {
    "root_cause": [
      {
        "type": "resource_already_exists_exception",
        "reason": "index [cedar-000001/7Kjlb7GfTvmIGjybK9n--Q] already exists",
        "index_uuid": "7Kjlb7GfTvmIGjybK9n--Q",
        "index": "cedar-000001"
      }
    ],
    "type": "resource_already_exists_exception",
    "reason": "index [cedar-000001/7Kjlb7GfTvmIGjybK9n--Q] already exists",
    "index_uuid": "7Kjlb7GfTvmIGjybK9n--Q",
    "index": "cedar-000001"
  },
  "status": 400
}

I created new index cedar-000001 and used alias 'cedar-log' if it works with '-' rather than '_' . The Index template doesn't pick the index but directly applying the policy to the index does. Its working with the policy directly and not with template.

6

You never said that. So are you creating the content from beats?

I ran the code you sent and got this

{
  "error": {
    "root_cause": [
      {
        "type": "resource_already_exists_exception",
        "reason": "index [cedar-000001/7Kjlb7GfTvmIGjybK9n--Q] already exists",
        "index_uuid": "7Kjlb7GfTvmIGjybK9n--Q",
        "index": "cedar-000001"
      }
    ],
    "type": "resource_already_exists_exception",
    "reason": "index [cedar-000001/7Kjlb7GfTvmIGjybK9n--Q] already exists",
    "index_uuid": "7Kjlb7GfTvmIGjybK9n--Q",
    "index": "cedar-000001"
  },
  "status": 400
}

Are you sure that you ran the first line?

7

Yes i ran it.
In my setup, filebeat is sending logs to logstash and it is storing it in elasticsearch. We will view the logs in kibana. To manage the storage, i'm using ILM.

input {
  beats {
    port => "5044"
  }
}
# The filter part of this file is commented out to indicate that it is
# optional.
# filter {
#
# }
output {
 elasticsearch {
    hosts => ["kibana.flyanra.net:9200"]
    #ssl => true
    user => "xxxxxx"
    password => "xxxxx"
    index => "cedar-000001"
    ilm_enabled => true
    #ilm_rollover_alias => "cedar_log"
    #index.lifecycle.rollover_alias => "cedar_log"
    #ilm_policy => "ilm_cedar"
    workers => 1
  }
stdout { codec => rubydebug }
}

This is my logstash.conf file.

8

You must write to the write alias, which I believe should be cedar-log according to David's example.

9

I had the same alias "cedar_log" for the index and rollover aliases. Somehow it didn't work but using "cedar-log" it worked.

10

@dadoonet Rollover is happening but the new indices does not have the data. cedar-000001 is storing all the data as it is mentioned in logstash.conf file. On rollover, the alias was removed from cedar-000001 index.

can you help me with this? need to make some changes in logstash.conf?

11

Logstash needs to write to:

index => "cedar-000001"

instead of

index => "cedar-logs"
13

@dadoonet im writing to the index name only

input {
  beats {
    port => "5044"
  }
}
# The filter part of this file is commented out to indicate that it is
# optional.
# filter {
#
# }
output {
 elasticsearch {
    hosts => ["kibana.flyanra.net:9200"]
    #ssl => true
    user => "elastic"
    password => "Anra_ElastiC321#"
    index => "cedar-000001"
    ilm_enabled => true
    #ilm_rollover_alias => "cedar_log"
    #index.lifecycle.rollover_alias => "cedar_log"
    #ilm_policy => "ilm_cedar"
    workers => 1
  }
stdout { codec => rubydebug }
}

Getting this error
[2023-06-01T09:50:56,409][ERROR][o.e.x.i.IndexLifecycleRunner] [ip-10-6-0-135] policy [ilm_cedar] for index [cedar-000012] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step
java.lang.IllegalArgumentException: rollover target [cedar-log] does not point to a write index

14

Sorry. I meant the opposite:

Logstash needs to write to:

index => "cedar-logs"
15

Thanks it works. However, i have attached the index to ILM policy directly. The template doesn't pick the index. I'm pasting it here if you could get what's wrong.

input {
  beats {
    port => "5044"
  }
}
# The filter part of this file is commented out to indicate that it is
# optional.
# filter {
#
# }
output {
 elasticsearch {
    hosts => ["kibana.flyanra.net:9200"]
    #ssl => true
    user => "elastic"
    password => "Anra_ElastiC321#"
    index => "cedar-log"
    ilm_enabled => true
    #ilm_rollover_alias => "cedar-log"
    #index.lifecycle.rollover_alias => "cedar_log"
    #ilm_policy => "ilm_cedar"
    workers => 1
  }
stdout { codec => rubydebug }
}

index template

{
  "template": {
    "settings": {
      "index": {
        "lifecycle": {
          "name": "ilm_cedar",
          "rollover_alias": "cedar-log"
        },
        "routing": {
          "allocation": {
            "include": {
              "_tier_preference": "data_content"
            }
          }
        },
        "number_of_shards": "1",
        "number_of_replicas": "1"
      }
    },
    "aliases": {},
    "mappings": {}
  }
}
16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.