# Data Stop ingesting after deleting index

**URL:** <https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027>\
**Category:** Elasticsearch\
**Created:** [November 19, 2020, 5:59pm UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027 "2020-11-19T17:59:01Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![bhijay](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bhijay](https://discuss.elastic.co/u/bhijay)\
**Post date:** [November 19, 2020, 5:59pm UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027/1 "2020-11-19T17:59:01Z")

</div>

Hello,

I mistakenly deleted the winlogbeat index. However, new data stopped ingesting after deletion.

What can I do?

Regards.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 20, 2020, 12:29am UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027/2 "2020-11-20T00:29:27Z")

</div>

Welcome to our community! 😃

It should just recreate the index. However it might be worth checking the Winlogbeat logs.

---

<div class="post-metadata">

**Author:** ![bhijay](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bhijay](https://discuss.elastic.co/u/bhijay)\
**Post date:** [November 20, 2020, 8:50am UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027/3 "2020-11-20T08:50:07Z")

</div>

Thanks @warkolm.

I trie: ./winlogbeat -c winlogbeat.yml -e

Here is the sample log:

2020-11-20T10:42:21.318+0200 WARN [elasticsearch] elasticsearch/client.go:407 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xb2af7b4, ext:63741309925, loc:(_time.Location)(nil)}, Meta:null, Fields:{"agent":{"ephemeral\_id":"70704326-43ec-41d8-a84d-2c4e1bf5a53a","hostname":"bolly-bobo","id":"ef0d400e-bff9-44dd-928b-3b32a27434f1","name":"bolly-bobo","type":"winlogbeat","version":"7.9.0"},"ecs":{"version":"1.5.0"},"event":{"action":"Process Termination","code":4689,"created":"2020-11-20T08:42:09.820Z","kind":"event","provider":"Microsoft-Windows-Security-Auditing"},"host":{"architecture":"x86\_64","hostname":"bolly-bobo","id":"9d11a3d6-2667-4b28-9ad0-7d42031df048","ip":_\*\*\*\*\*\*\*\*"SubjectUserSid":"S-1-5-18"},"event\_id":4689,"keywords":["Audit Success"],"opcode":"Info","process":{"pid":4,"thread":{"id":7116}},"provider\_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider\_name":"Microsoft-Windows-Security-Auditing","record\_id":1949010,"task":"Process Termination"}}, Private:checkpoint.EventLogState{Name:"Security", RecordNumber:0x1dbd52, Timestamp:time.Time{wall:0xb2af7b4, ext:63741309925, loc:(\*time.Location)(nil)}, Bookmark:"\r\n \r\n"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal\_argument\_exception","reason":"no write index is defined for alias [winlogbeat-7.9.0]. The write index may be explicitly disabled using is\_write\_index=false or the alias points to multiple indices without one being designated as a write index"}

I made a new index with is\_write\_index set to true. Still no luck.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 22, 2020, 9:05pm UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027/4 "2020-11-22T21:05:45Z")

</div>

> [@bhijay](#):
>
> no write index is defined for alias [winlogbeat-7.9.0]. The write index may be explicitly disabled using is\_write\_index=false or the alias points to multiple indices without one being designated as a write index

Are you using ILM?

---

<div class="post-metadata">

**Author:** ![bhijay](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bhijay](https://discuss.elastic.co/u/bhijay)\
**Post date:** [November 22, 2020, 9:26pm UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027/5 "2020-11-22T21:26:49Z")

</div>

Yes, I am using ILM

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 23, 2020, 12:24am UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027/6 "2020-11-23T00:24:39Z")

</div>

What's the output from the \_cat/aliases/winlogbeat-7.9.0?v` API?

---

<div class="post-metadata">

**Author:** ![bhijay](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bhijay](https://discuss.elastic.co/u/bhijay)\
**Post date:** [November 23, 2020, 4:58am UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027/7 "2020-11-23T04:58:32Z")

</div>

> [@warkolm](#):
>
> \_cat/aliases/winlogbeat-7.9.0?v`

alias index filter routing.index routing.search is\_write\_index  
winlogbeat-7.9.0 winlogbeat-7.9.0-2020.08.24-000001 - - - false

---

<div class="post-metadata">

**Author:** ![bhijay](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bhijay](https://discuss.elastic.co/u/bhijay)\
**Post date:** [November 25, 2020, 7:27am UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027/8 "2020-11-25T07:27:33Z")

</div>

@warkolm any hint you can suggest?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2020, 7:28am UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027/9 "2020-12-23T07:28:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.