[copy] Data Stop ingesting after deleting index

Hello all! i not found a solution for my problem, but i found this post with same problem.
And when i found a solution, i discovered what i cant write it in this post.
that's why i registered here and created this post, i hope anyone can searched the answer on this problem.

Problem is:
Data Stop ingesting after deleting index.

no write index is defined for alias. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index.

filebeat cant create a needed index;
we need to look logs of filebeat (or config if you change it) to know whats index pattern-name he try to create;
in my case this is [filebeat-7.17.0];
look already created indicies as

GET _cat/indices/filebeat-7.17.0


yellow open filebeat-7.17.0-2022.02.07-000001 8p2d9dCzRLaep7Ot0oSE3A 1 1 11121533 0 7.1gb 7.1gb
yellow open filebeat-7.17.0-2022.05.08-000004 QU6NFvpaQlqdYhG2fUYahQ 1 1  6114772 0 3.6gb 3.6gb
yellow open filebeat-7.17.0-2022.03.09-000002 TUj4SjfBT7O5zv37S7GUVw 1 1  6293816 0 3.7gb 3.7gb
yellow open filebeat-7.17.0-2022.04.08-000003 Hxl6UBgLTjyrsdSUnqTAGQ 1 1  6237151 0 3.6gb 3.6gb

next, create new index as same pattern with current date:

PUT /filebeat-7.17.0-2022.07.26-000001

next, create alias for this indicies

POST _aliases
  "actions": [
      "add": {
        "index": "filebeat-7.17.0-2022.07.26-000001",
        "alias": "filebeat-7.17.0",
        "is_write_index" : true

next we need restart the filebeat and he should start writing - problem solved;

I hope this helps those who are facing the same problem.

Also, in my opinion, the platform lacks the functionality of answering unresolved questions. I didn't find any other way than creating a new post

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.