Data stream index Rollover exception "..names need to be unique.."


We have an index that is returning:
illegal_state_exception: index, alias, and data stream names need to be unique, but the following duplicates were found [ (alias of []) conflicts with data stream]

This index doesn't exist yet.

We believe this is because index was initially created with an old template and then converted to data stream backing index (if that is even possible). We can see from the screenshot that it has alias from legacy index template: logs-network_azure_firewall-default
To my understanding .ds indexes shouldn't have aliases.

Legacy index template had an order of 0.

I've tried deleting that alias with API but it returns: "reason" : "The provided expressions [] match a backing index belonging to data stream []. Data streams and their backing indices don't support aliases."

Forcing rollover with API also doesn't work.

Cloning also won't work because:

The current write index on a data stream cannot be cloned. In order to clone the current write index, the data stream must first be rolled over so that a new write index is created and then the previous write index can be cloned.

Creating new index with API didn't work.

Should we try to reindex it somehow into some new index with different name just to have it backed up, and then delete it?

What can we do to fix this?


Full stack trace:

java.lang.IllegalStateException: index, alias, and data stream names need to be unique, but the following duplicates were found [ (alias of []) conflicts with data stream]
at org.elasticsearch.cluster.metadata.Metadata$
at org.elasticsearch.cluster.metadata.MetadataCreateIndexService.clusterStateCreateIndex(
at org.elasticsearch.cluster.metadata.MetadataCreateIndexService.lambda$applyCreateIndexWithTemporaryService$3(
at org.elasticsearch.indices.IndicesService.withTempIndexService(
at org.elasticsearch.cluster.metadata.MetadataCreateIndexService.applyCreateIndexWithTemporaryService(
at org.elasticsearch.cluster.metadata.MetadataCreateIndexService.applyCreateIndexRequestWithV2Template(
at org.elasticsearch.cluster.metadata.MetadataCreateIndexService.applyCreateIndexRequest(
at org.elasticsearch.action.admin.indices.rollover.MetadataRolloverService.rolloverDataStream(
at org.elasticsearch.action.admin.indices.rollover.MetadataRolloverService.rolloverClusterState(
at org.elasticsearch.action.admin.indices.rollover.TransportRolloverAction$1$1.execute(
at org.elasticsearch.cluster.ClusterStateUpdateTask.execute(
at org.elasticsearch.cluster.service.MasterService.executeTasks(
at org.elasticsearch.cluster.service.MasterService.calculateTaskOutputs(
at org.elasticsearch.cluster.service.MasterService.runTasks(
at org.elasticsearch.cluster.service.MasterService.access$000(
at org.elasticsearch.cluster.service.MasterService$
at org.elasticsearch.cluster.service.TaskBatcher.runIfNotProcessed(
at org.elasticsearch.cluster.service.TaskBatcher$
at org.elasticsearch.common.util.concurrent.ThreadContext$
at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(
at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(
at java.base/java.util.concurrent.ThreadPoolExecutor$
at java.base/

I had also tried changing the order in that legacy index template but it didn't work.

I have deleted the template now and it still doesn't work.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.