Im attempting to use packetbeat though am having issues as the ILM doesn't seem to want to execute properly. I installed it via packetbeat setup but changed it as follows:
"phase_definition" : {
"min_age" : "0ms",
"actions" : {
"rollover" : {
"max_size" : "25gb",
"max_age" : "3h"
}
}
After it runs for a bit I get this exception
GET packetbeat-7.3.1-2019.09.09-000001/_ilm/explain
{
"indices" : {
"packetbeat-7.3.1-2019.09.09-000001" : {
"index" : "packetbeat-7.3.1-2019.09.09-000001",
"managed" : true,
"policy" : "packetbeat-7.3.1",
"lifecycle_date_millis" : 1567983671940,
"phase" : "hot",
"phase_time_millis" : 1567983672554,
"action" : "rollover",
"action_time_millis" : 1567983808893,
"step" : "ERROR",
"step_time_millis" : 1567984408599,
"failed_step" : "check-rollover-ready",
"step_info" : {
"type" : "illegal_argument_exception",
"reason" : "index.lifecycle.rollover_alias [packetbeat-7.3.1] does not point to index [packetbeat-7.3.1-2019.09.09-000001]",
"stack_trace" : """
java.lang.IllegalArgumentException: index.lifecycle.rollover_alias [packetbeat-7.3.1] does not point to index [packetbeat-7.3.1-2019.09.09-000001]
at org.elasticsearch.xpack.core.indexlifecycle.WaitForRolloverReadyStep.evaluateCondition(WaitForRolloverReadyStep.java:92)
at org.elasticsearch.xpack.indexlifecycle.IndexLifecycleRunner.runPeriodicStep(IndexLifecycleRunner.java:133)
at org.elasticsearch.xpack.indexlifecycle.IndexLifecycleService.triggerPolicies(IndexLifecycleService.java:270)
at org.elasticsearch.xpack.indexlifecycle.IndexLifecycleService.triggered(IndexLifecycleService.java:213)
at org.elasticsearch.xpack.core.scheduler.SchedulerEngine.notifyListeners(SchedulerEngine.java:168)
at org.elasticsearch.xpack.core.scheduler.SchedulerEngine$ActiveSchedule.run(SchedulerEngine.java:196)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:835)
"""
},
"phase_execution" : {
"policy" : "packetbeat-7.3.1",
"phase_definition" : {
"min_age" : "0ms",
"actions" : {
"rollover" : {
"max_size" : "25gb",
"max_age" : "3h"
}
}
},
"version" : 3,
"modified_date_in_millis" : 1567955517888
}
}
}
}