# Cannot find write index **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [May 30, 2023, 12:33pm UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683 "2023-05-30T12:33:26Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Shreyansh\_Narang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shreyansh_narang/32/117858_2.png) [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\ **Post date:** [May 30, 2023, 12:33pm UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/1 "2023-05-30T12:33:26Z")
Getting below error policy [ilm\_cedar] for index [cedar-00001] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step java.lang.IllegalArgumentException: rollover target [cedar\_log] does not point to a write index The bootstrap command gives bad request error. PUT cedar-00001 { "aliases": { "cedar\_log": { "is\_write\_index": true } } } The Output { "error": { "root\_cause": [ { "type": "resource\_already\_exists\_exception", "reason": "index [cedar-00001/Ee4slVvzTku\_EgbW17yU-g] already exists", "index\_uuid": "Ee4slVvzTku\_EgbW17yU-g", "index": "cedar-00001" } ], "type": "resource\_already\_exists\_exception", "reason": "index [cedar-00001/Ee4slVvzTku\_EgbW17yU-g] already exists", "index\_uuid": "Ee4slVvzTku\_EgbW17yU-g", "index": "cedar-00001" }, "status": 400 } Can anyone guide me? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 30, 2023, 12:54pm UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/2 "2023-05-30T12:54:52Z")
Welcome! Please [read this](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) about how to format. You need to use [the update settings API](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-update-settings.html) and not the create index if your index already exists I guess. ```auto PUT /cedar-00001/_settings { "aliases" : { "cedar_log" : { "is_write_index": true } } } ``` But I don't know if this is what you really want to do... ---
**Author:** ![Shreyansh\_Narang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shreyansh_narang/32/117858_2.png) [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\ **Post date:** [May 31, 2023, 7:52am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/3 "2023-05-31T07:52:50Z")
Hi @dadoonet , I have index created through logstash. I want to apply lifecycle policy to it to retain logs for 3 days. For testing purpose i have created this policy. ```auto "ilm_cedar": { "version": 2, "modified_date": "2023-05-30T10:20:34.684Z", "policy": { "phases": { "hot": { "min_age": "0ms", "actions": { "set_priority": { "priority": 100 }, "rollover": { "max_age": "55s" } } }, "delete": { "min_age": "1m", "actions": { "delete": { "delete_searchable_snapshot": true } } } } }, "in_use_by": { "indices": [], "data_streams": [], "composable_templates": [ "cedar_template", "cedar_log_temp" ] } }, ``` I'm using index template to apply the policy to the index. ```auto { "index_templates": [ { "name": "cedar_log_temp", "index_template": { "index_patterns": [ "cedar-*" ], "template": { "settings": { "index": { "lifecycle": { "name": "ilm_cedar", "rollover_alias": "cedar_log" }, "number_of_shards": "1", "number_of_replicas": "1" } } }, "composed_of": [] } } ] } ``` I'm getting the error policy [ilm\_cedar] for index [cedar-00001] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step java.lang.IllegalArgumentException: rollover target [cedar\_log] does not point to a write index. I tried the update settings API from your response but getting this error. FYI, im using BASIC license. ```auto { "error": { "root_cause": [ { "type": "illegal_argument_exception", "reason": "unknown setting [index.aliases.cedar_log.is_write_index] please check that any required plugins are installed, or check the breaking changes documentation for removed settings" } ], "type": "illegal_argument_exception", "reason": "unknown setting [index.aliases.cedar_log.is_write_index] please check that any required plugins are installed, or check the breaking changes documentation for removed settings" }, "status": 400 } ``` ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 31, 2023, 8:59am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/4 "2023-05-31T08:59:30Z")
As it's a test, I'd run: ```auto DELETE /cedar-00001 PUT /cedar-00001 { "aliases" : { "cedar-log" : { "is_write_index": true } } } ``` Note that I'm using `cedar-log` instead of `cedar_log`. Note sure it's important but this is what I can see [from the doc](https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-lifecycle-policy.html#create-initial-index) 😉 . ---
**Author:** ![Shreyansh\_Narang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shreyansh_narang/32/117858_2.png) [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\ **Post date:** [May 31, 2023, 12:29pm UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/5 "2023-05-31T12:29:31Z")
According to the document, we don't need to bootstrap an index from beats and logstash. I ran the code you sent and got this ```auto { "error": { "root_cause": [ { "type": "resource_already_exists_exception", "reason": "index [cedar-000001/7Kjlb7GfTvmIGjybK9n--Q] already exists", "index_uuid": "7Kjlb7GfTvmIGjybK9n--Q", "index": "cedar-000001" } ], "type": "resource_already_exists_exception", "reason": "index [cedar-000001/7Kjlb7GfTvmIGjybK9n--Q] already exists", "index_uuid": "7Kjlb7GfTvmIGjybK9n--Q", "index": "cedar-000001" }, "status": 400 } ``` I created new index cedar-000001 and used alias 'cedar-log' if it works with '-' rather than '\_' . The Index template doesn't pick the index but directly applying the policy to the index does. Its working with the policy directly and not with template. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 31, 2023, 12:56pm UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/6 "2023-05-31T12:56:21Z")
> [@Shreyansh\_Narang](#): > > According to the document, we don't need to bootstrap an index from beats and logstash. You never said that. So are you creating the content from beats? > I ran the code you sent and got this > > ```auto > { > "error": { > "root_cause": [ > { > "type": "resource_already_exists_exception", > "reason": "index [cedar-000001/7Kjlb7GfTvmIGjybK9n--Q] already exists", > "index_uuid": "7Kjlb7GfTvmIGjybK9n--Q", > "index": "cedar-000001" > } > ], > "type": "resource_already_exists_exception", > "reason": "index [cedar-000001/7Kjlb7GfTvmIGjybK9n--Q] already exists", > "index_uuid": "7Kjlb7GfTvmIGjybK9n--Q", > "index": "cedar-000001" > }, > "status": 400 > } > > ``` Are you sure that you ran the first line? ---
**Author:** ![Shreyansh\_Narang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shreyansh_narang/32/117858_2.png) [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\ **Post date:** [June 1, 2023, 5:38am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/7 "2023-06-01T05:38:02Z")
Yes i ran it. In my setup, filebeat is sending logs to logstash and it is storing it in elasticsearch. We will view the logs in kibana. To manage the storage, i'm using ILM. ```auto input { beats { port => "5044" } } # The filter part of this file is commented out to indicate that it is # optional. # filter { # # } output { elasticsearch { hosts => ["kibana.flyanra.net:9200"] #ssl => true user => "xxxxxx" password => "xxxxx" index => "cedar-000001" ilm_enabled => true #ilm_rollover_alias => "cedar_log" #index.lifecycle.rollover_alias => "cedar_log" #ilm_policy => "ilm_cedar" workers => 1 } stdout { codec => rubydebug } } ``` This is my logstash.conf file. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 1, 2023, 6:07am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/8 "2023-06-01T06:07:12Z")
> [@Shreyansh\_Narang](#): > > `index => "cedar-000001"` You must write to the write alias, which I believe should be `cedar-log` according to David's example. ---
**Author:** ![Shreyansh\_Narang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shreyansh_narang/32/117858_2.png) [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\ **Post date:** [June 1, 2023, 6:17am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/9 "2023-06-01T06:17:16Z")
I had the same alias "cedar\_log" for the index and rollover aliases. Somehow it didn't work but using "cedar-log" it worked. ---
**Author:** ![Shreyansh\_Narang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shreyansh_narang/32/117858_2.png) [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\ **Post date:** [June 1, 2023, 8:25am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/10 "2023-06-01T08:25:37Z")
@dadoonet Rollover is happening but the new indices does not have the data. cedar-000001 is storing all the data as it is mentioned in logstash.conf file. On rollover, the alias was removed from cedar-000001 index. can you help me with this? need to make some changes in logstash.conf? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 1, 2023, 8:48am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/11 "2023-06-01T08:48:50Z")
Logstash needs to write to: ``` index => "cedar-000001" ``` instead of ``` index => "cedar-logs" ``` ---
**Author:** ![Shreyansh\_Narang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shreyansh_narang/32/117858_2.png) [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\ **Post date:** [June 1, 2023, 9:55am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/13 "2023-06-01T09:55:45Z")
@dadoonet im writing to the index name only ```auto input { beats { port => "5044" } } # The filter part of this file is commented out to indicate that it is # optional. # filter { # # } output { elasticsearch { hosts => ["kibana.flyanra.net:9200"] #ssl => true user => "elastic" password => "Anra_ElastiC321#" index => "cedar-000001" ilm_enabled => true #ilm_rollover_alias => "cedar_log" #index.lifecycle.rollover_alias => "cedar_log" #ilm_policy => "ilm_cedar" workers => 1 } stdout { codec => rubydebug } } ``` Getting this error [2023-06-01T09:50:56,409][ERROR][o.e.x.i.IndexLifecycleRunner] [ip-10-6-0-135] policy [ilm\_cedar] for index [cedar-000012] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step java.lang.IllegalArgumentException: rollover target [cedar-log] does not point to a write index ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 1, 2023, 5:01pm UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/14 "2023-06-01T17:01:25Z")
Sorry. I meant the opposite: Logstash needs to write to: ```auto index => "cedar-logs" ``` ---
**Author:** ![Shreyansh\_Narang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shreyansh_narang/32/117858_2.png) [@Shreyansh\_Narang](https://discuss.elastic.co/u/Shreyansh_Narang)\ **Post date:** [June 2, 2023, 11:46am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/15 "2023-06-02T11:46:41Z")
Thanks it works. However, i have attached the index to ILM policy directly. The template doesn't pick the index. I'm pasting it here if you could get what's wrong. ```auto input { beats { port => "5044" } } # The filter part of this file is commented out to indicate that it is # optional. # filter { # # } output { elasticsearch { hosts => ["kibana.flyanra.net:9200"] #ssl => true user => "elastic" password => "Anra_ElastiC321#" index => "cedar-log" ilm_enabled => true #ilm_rollover_alias => "cedar-log" #index.lifecycle.rollover_alias => "cedar_log" #ilm_policy => "ilm_cedar" workers => 1 } stdout { codec => rubydebug } } ``` index template ```auto { "template": { "settings": { "index": { "lifecycle": { "name": "ilm_cedar", "rollover_alias": "cedar-log" }, "routing": { "allocation": { "include": { "_tier_preference": "data_content" } } }, "number_of_shards": "1", "number_of_replicas": "1" } }, "aliases": {}, "mappings": {} } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 30, 2023, 11:46am UTC](https://discuss.elastic.co/t/cannot-find-write-index/334683/16 "2023-06-30T11:46:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.