# Elasticsearch Create Wrong time based Index

**URL:** <https://discuss.elastic.co/t/elasticsearch-create-wrong-time-based-index/272785>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [May 12, 2021, 8:42am UTC](https://discuss.elastic.co/t/elasticsearch-create-wrong-time-based-index/272785 "2021-05-12T08:42:59Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![andreidan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andreidan/32/78167_2.png) [@andreidan](https://discuss.elastic.co/u/andreidan)\
**Post date:** [May 13, 2021, 2:12pm UTC](https://discuss.elastic.co/t/elasticsearch-create-wrong-time-based-index/272785/4 "2021-05-13T14:12:13Z")

</div>

Thanks for using Elasticsearch and ILM.

[Date math](https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html) on rollover is based on a hidden index setting called `index.provided_name`.

When you executed

```auto
PUT log-wlb-sysmon-2021.04.26-000002
{
 "aliases": {
   "log-wlb-sysmon": {
      "is_write_index": true 
   }
 }
}

```

the index was created as a regular index that has a date in its name, but date math was not configured.

Unfortunately there is no way to enable date math for an index after it's been created (`index.provided_name` is a private, internal setting). However you can create a new index with date math configured and then switch the `is_write_index` alias config from `log-wlb-sysmon-2021.04.26-000002` to the new index you created.

eg (please adapt the indices names to match your current state)

```auto
// this will create log-wlb-sysmon-2021.04.26-000001
PUT %3Clog-wlb-sysmon-%7Bnow%2Fd%7D-000001%3E 
{
"aliases": {
   "log-wlb-sysmon": {
      "is_write_index": false // keep it false for now as log-wlb-sysmon-2021.04.26-000002 is still the write_index for this alias
   }
 }
}

// swap the write alias from the previous index to the newly created one
POST _aliases
{
  "actions": [
    {
      "add": {
        "index": "log-wlb-sysmon-2021.04.26-000002",
        "alias": "log-wlb-sysmon",
        "is_write_index": false
      }
    }, {
      "add": {
        "index": "log-wlb-sysmon-2021.05.13-000001",
        "alias": "log-wlb-sysmon",
        "is_write_index": true
      }
    }
  ]
}

```

You can verify the new index has date math configured by issuing a  
`GET log-wlb-sysmon-2021.04.26-000001/_settings` and looking for the setting

```auto
"index": {
   ... 
        "provided_name": "<log-wlb-sysmon-{now/d}-000001>",
   ...
}

```

---

_[View the full topic](https://discuss.elastic.co/t/elasticsearch-create-wrong-time-based-index/272785)._