Disk Full problem winlogbeat

Elastic Stack Elasticsearch
1

I was running out of space on node and deleted multiple indexes, now there is space but in winlogbeat I have the following error.

2020-10-20T21:51:15.360-0300 ERROR [elasticsearch] elasticsearch/client.go:213 Failed to perform any bulk index operations: 400 Bad Request: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"no write index is defined for alias [winlogbeat-7.7.0]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"}],"type":"illegal_argument_exception","reason":"no write index is defined for alias [winlogbeat-7.7.0]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"},"status":400}

2

Hello Pablo,

You seem to have enabled Index Lifecycle management and deleted the active index. ILM works by having an alias winlogbeat-7.7.0 which points to one or more indexes but it has only 1 active index where the incoming data is written to.
As a solution you have to bootstrap the write index manually (the number might change depending on how many indexes are already created and how you configured your ILM settings):

PUT winlogbeat-7.7.0-000001
{
  "aliases": {
    "winlogbeat-7.7.0": {
      "is_write_index": true
    }
  }
}

Best regards
Wolfram

3

Thanks, it worked well.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.