Create multiple index str in filebeat and send logs to them with successfully rolover to next index

[Ananya (ananyasahoo)]

Hello, I am trying to implement ilm policy. I have multiple index str so I create multiple aliases with their respective bootstrapping index to support them and set is_write_index to true.
The logs flow to the bootstrap index and gets rollover to the next index but then logs don't flow to the 2nd index and the document count shows empty. Can any one help how can I move rollover index properly to the correct index automatically.
...
indices:
- index: "app1-000001"
when.contains:
logType: "app1-{{ server_env }}"
- index: "app2-000001"
when.contains:
logType: "app2-{{ server_env }}"
- index: "app3-000001"
when.contains:
logType: "app3-{{ server_env }}"
...
this is the bootsrap index-
...
PUT app1-000001
{
"aliases": {
"onejane-app1": {
"is_write_index": true
}
}
}
...
this is one of the template
...
{
"index_patterns": [
"app1-*"
],
"template": {
"settings": {
"number_of_shards": 1,
"number_of_replicas": 1,
"index.lifecycle.name": "onejane_policy",
"index.lifecycle.rollover_alias": "onejane_app1"
}
}
}
...