Hello everyone, the question may be stupid, but I want to clarify: aliases in elasticsearch are essentially like links to one or more indexes or data streams, but recently during the creation of the ILM, I saw an error - "index.lifecycle.rollover_alias" is empty or not defined, so, this "index.lifec…

Take a look at this part of the docs. It relates to the read alias once the underlying index has been rolled over. [image] alex_96: the question may be stupid The only stupid question is the one that is unasked.

Such a question, I read the manual and I seem to have done everything right, but I still get an error for indices, I use the vazuh template and add the following to it: { "order": 0, "index_patterns": [ "wazuh-alerts-4.x-*", "wazuh-archives-4.x-*" ], "settings": { "index.refres…

I believe you need to create one index template per index pattern as two patterns can not share a rollover alias.

Correct understanding of "aliases" in elasticsearch

Elastic Stack Elasticsearch

Topic		Replies	Views
Illegal_argument_exception: index.lifecycle.rollover_alias is empty or not defined Elasticsearch ilm-index-lifecycle-management	1	2183	February 7, 2022
Error index.lifecycle.rollover_alias does not pointto index Elasticsearch ilm-index-lifecycle-management	4	2351	March 25, 2020
Setting [index.lifecycle.rollover_alias] for index [y] is empty or not defined Elasticsearch ilm-index-lifecycle-management , datastreams	2	7662	December 14, 2021
Index Rollover alias Elasticsearch	3	1261	August 12, 2019
Index.lifecycle.rollover_alias is Empty Elasticsearch ilm-index-lifecycle-management	1	3063	December 2, 2019

Correct understanding of "aliases" in elasticsearch

Related topics