Elasticsearch Create Wrong time based Index

Elastic Stack Elasticsearch
4

Thanks for using Elasticsearch and ILM.

Date math on rollover is based on a hidden index setting called index.provided_name.

When you executed

PUT log-wlb-sysmon-2021.04.26-000002
{
 "aliases": {
   "log-wlb-sysmon": {
      "is_write_index": true 
   }
 }
}

the index was created as a regular index that has a date in its name, but date math was not configured.

Unfortunately there is no way to enable date math for an index after it's been created (index.provided_name is a private, internal setting). However you can create a new index with date math configured and then switch the is_write_index alias config from log-wlb-sysmon-2021.04.26-000002 to the new index you created.

eg (please adapt the indices names to match your current state)

// this will create log-wlb-sysmon-2021.04.26-000001
PUT %3Clog-wlb-sysmon-%7Bnow%2Fd%7D-000001%3E 
{
"aliases": {
   "log-wlb-sysmon": {
      "is_write_index": false      // keep it false for now as log-wlb-sysmon-2021.04.26-000002 is still the write_index for this alias
   }
 }
}

// swap the write alias from the previous index to the newly created one
POST _aliases
{
  "actions": [
    {
      "add": {
        "index": "log-wlb-sysmon-2021.04.26-000002",
        "alias": "log-wlb-sysmon",
        "is_write_index": false
      }
    }, {
      "add": {
        "index": "log-wlb-sysmon-2021.05.13-000001",
        "alias": "log-wlb-sysmon",
        "is_write_index": true
      }
    }
  ]
}

You can verify the new index has date math configured by issuing a
GET log-wlb-sysmon-2021.04.26-000001/_settings and looking for the setting

"index": {
   ... 
        "provided_name": "<log-wlb-sysmon-{now/d}-000001>",
   ...
}