Hello all! i not found a solution for my problem, but i found this post with same problem.
And when i found a solution, i discovered what i cant write it in this post.
that's why i registered here and created this post, i hope anyone can searched the answer on this problem.
Problem is:
Data Stop ingesting after deleting index.
no write index is defined for alias. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index.
Solution:
filebeat cant create a needed index;
we need to look logs of filebeat (or config if you change it) to know whats index pattern-name he try to create;
in my case this is [filebeat-7.17.0];
look already created indicies as
GET _cat/indices/filebeat-7.17.0
result:
yellow open filebeat-7.17.0-2022.02.07-000001 8p2d9dCzRLaep7Ot0oSE3A 1 1 11121533 0 7.1gb 7.1gb
yellow open filebeat-7.17.0-2022.05.08-000004 QU6NFvpaQlqdYhG2fUYahQ 1 1 6114772 0 3.6gb 3.6gb
yellow open filebeat-7.17.0-2022.03.09-000002 TUj4SjfBT7O5zv37S7GUVw 1 1 6293816 0 3.7gb 3.7gb
yellow open filebeat-7.17.0-2022.04.08-000003 Hxl6UBgLTjyrsdSUnqTAGQ 1 1 6237151 0 3.6gb 3.6gb
next, create new index as same pattern with current date:
PUT /filebeat-7.17.0-2022.07.26-000001
next, create alias for this indicies
POST _aliases
{
"actions": [
{
"add": {
"index": "filebeat-7.17.0-2022.07.26-000001",
"alias": "filebeat-7.17.0",
"is_write_index" : true
}
}
]
}
next we need restart the filebeat and he should start writing - problem solved;
I hope this helps those who are facing the same problem.
Also, in my opinion, the platform lacks the functionality of answering unresolved questions. I didn't find any other way than creating a new post