Date format increasing doesn't work

Elastic Stack Beats
,
1

After assigning my ILM policy as follows:

PUT /_ilm/policy/my_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "30d"
          }
        }
      }
    }
  }
}

And configuring my Metricbeat file with date-based indexing as follows:

output.elasticsearch:
  hosts: ***
  protocol: "https"
  username: ***
  password: ****
  index: "metric-example-%{+yyyy.MM.dd}"

However, I noticed that it only works for one day, such as "2023-09-20," and does not proceed to the next day. Why is this error occurring?

When I try to index without specifying the date, like "PUT metricbeat-***," I encounter the following error:

{
  "error": {
    "root_cause": [
      {
        "type": "invalid_index_name_exception",
        "reason": "Invalid index name [pororometrics], already exists as alias",
        "index_uuid": "_na_",
        "index": "pororometrics"
      }
    ],
    "type": "invalid_index_name_exception",
    "reason": "Invalid index name [pororometrics], already exists as alias",
    "index_uuid": "_na_",
    "index": "pororometrics"
  },
  "status": 400
}

and for my first index, it turns like "<metrics-{now/d}-000001>" for provided_name. I think it should be metrics-2023-09-20-00001.

{
  "settings": {
    "index": {
      "mapping": {
        "total_fields": {
          "limit": "10000"
        }
      },
      "refresh_interval": "30s",
      "provided_name": "<metrics-{now/d}-000001>",
      "query": {
        "default_field": [

Can you explain why these issues are happening?

2

This is my question-and-answer.

If you have/wanted to set an alias alias (ex. setup.ilm.rollover_alias: "hellometrics”) to the index, set is_write_index: true to the alias as stated in the official document here(Rollover API | Elasticsearch Guide [master] | Elastic) so that the date and rollover are written separately in the alias. Be careful to specify it!

# PUT <my-index-{now/d}-000001>
PUT %3Cmy-index-%7Bnow%2Fd%7D-000001%3E
{
  "aliases": {
    "my-alias": {
      "is_write_index": true
    }
  }
}

You'd better write your xml file like this.

metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
  reload.period: 10s

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
setup.template.name: "metric-secret"
setup.template.pattern: "metric-secret-*"
setup.template.overwrite: false
setup.ilm.enabled: false
setup.ilm.policy_name: "my_policy"
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.