Facing error while rollover based on alias and template in 5.6.0

[thenextfreelancer (Moksh)]

Hi,

I am facing a strange problem while rollover of a particular alias.
Error:

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "index name [twitter] does not match pattern '^.*-\\d+$'"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "index name [twitter] does not match pattern '^.*-\\d+$'"
  },
  "status": 400
}

I have a template as below:

{
     "template": "twitter-*",
     "settings": {
       "number_of_shards": 3
     },
     "mappings" : {
           "user" : {
             "properties" : {
                "name" : { "type" : "text" },
                    "id" : { "type" : "text" }
              }
          }
      }
 }

And alias list

 GET /_aliases

{
  "twitter": {
    "aliases": {}
  },
  ".kibana": {
    "aliases": {}
  },
  "twitter-2019.06.09-1": {
    "aliases": {
      "twitter-alias": {}
    }
  },
  "twitter123": {
    "aliases": {}
  }
}

I have created twitter-2019.06.09-1 from twitter index by takng snapshot and restore process.

Whenever I try following rollover manually(I was setting it up by curator), I face above error.

#Running manual rollover
POST /twitter-alias/_rollover/
{
  "conditions": {
    "max_age":   "7d",
    "max_docs":  1
  }
}

twitter-2019.06.09-1 has following 3 records:

GET twitter-2019.06.09-1/user/_search?size=0
{
  "took": 44,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 3,
    "max_score": 0,
    "hits": [ ]
  }
}

I have tried deleting the twitter index because it is of no use but same error happening by rollover api.

Please help.

Update:

After reading below post:

Rollover Failing

It may help to be even more name specific with the aliases, e.g. index data to the rollover-alias, and search data from the search-alias. Whatever makes sense to you. You have to understand, though, that you can't even ship data to an alias that points to more than one index. An alias that points to one and only one index can be used to read and write data. An alias that points to more than one index is read-only.

I updated the template and index alias list as below:

#Creating template for new index creation
PUT _template/template_1
{
  "template": "twitter-*",
  "settings": {
    "number_of_shards": 3
  },
"mappings" : {
        "user" : {
            "properties" : {
                "name" : { "type" : "text" },
                "id" : { "type" : "text" }
            }
        }
    },
    "aliases":
    {
    "search-all":{}
    }
}

And Index:

GET twitter-2019.06.09-1
{
  "twitter-2019.06.09-1": {
    "aliases": {
      "search-all": {},
      "twitter-alias": {}
    },
    "mappings": {
      "user": {
        "properties": {
          "id": {
            "type": "text"
          },
          "name": {
            "type": "text"
          }
        }
      }
    },
    "settings": {
      "index": {
        "creation_date": "1559904447882",
        "number_of_shards": "1",
        "number_of_replicas": "1",
        "uuid": "DnUZcHiyQIi2ab8XVKKVuA",
        "version": {
          "created": "5060099"
        },
        "provided_name": "twitter"
      }
    }
  }
}

Issue still exit.

I noticed

"provided_name": "twitter"

while checking index info.

Is it related to the above error posted? It should not be twitter.

My renaming index stretegy was:

#Taking snapshot
PUT /_snapshot/eaa-backup/twitter_snapshot
{
  "indices": "twitter",
  "ignore_unavailable": true,
  "include_global_state": false
}

And Restore:

#Now restore with new name
POST /_snapshot/eaa-backup/twitter_snapshot/_restore
{
 "indices": "twitter",
 "ignore_unavailable": "true",
 "include_global_state": false,
 "rename_pattern": "twitter",
 "rename_replacement": "twitter-2019.06.09-1"
 }

Please help.

[theuntergeek (Aaron Mildenstein)]

Your question is hard to pin down, because you are saying so many things with so many examples.

@thenextfreelancer

"reason": "index name [twitter] does not match pattern '^.*-\d+$'"

Rollover indices must end in a dash and a number, typically (you have to go through hoops with the rollover API calls to get around this). Curator was checking for the index associated with your rollover alias (which is twitter in the pasted block), which does not end with a dash and a number.

I'm not quite sure what you're doing wrong. Here's a working example:

PUT twitter-2019.06.09-1
{
  "aliases": {
    "twitter-alias": {
      "is_write_index": true
    }
  }
}

PUT twitter-alias/_doc/1
{
  "doc1": "dummy_doc1"
}
PUT twitter-alias/_doc/2
{
  "doc2": "dummy_doc2"
}

RESULT:

{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "old_index" : "twitter-2019.06.09-1",
  "new_index" : "twitter-2019.06.09-000002",
  "rolled_over" : true,
  "dry_run" : false,
  "conditions" : {
    "[max_docs: 1]" : true
  }
}

Additionally:

GET twitter-alias

Yields:

{
  "twitter-2019.06.09-000002" : {
    "aliases" : {
      "twitter-alias" : {
        "is_write_index" : true
      }
    },
    "mappings" : {...},
    "settings" : {
      "index" : {
        "creation_date" : "1560216263049",
        "number_of_shards" : "1",
        "number_of_replicas" : "1",
        "uuid" : "kMd6jt_dSWKSCW4ertSuLg",
        "version" : {
          "created" : "7010099"
        },
        "provided_name" : "twitter-2019.06.09-000002"
      }
    }
  },
  "twitter-2019.06.09-1" : {
    "aliases" : {
      "twitter-alias" : {
        "is_write_index" : false
      }
    },
    "mappings" : {...},
    "settings" : {
      "index" : {
        "creation_date" : "1560216199250",
        "number_of_shards" : "1",
        "number_of_replicas" : "1",
        "uuid" : "zjIKove5SXqAXSEfseYpQg",
        "version" : {
          "created" : "7010099"
        },
        "provided_name" : "twitter-2019.06.09-1"
      }
    }
  }
}

[thenextfreelancer (Moksh)]

Thanks for the reply and sorry for this much unorganized information.

Yeah, I read that post where you have said the same thing.

Actually, I tried today morning and found out the same you mentioned after doing everything fresh. It seems somehow while renaming index by taking snapshot and restore, that

"provided_name": "twitter"

property was wrongly set and that is why I was facing problem. It should be set to

twitter-2019.06.09-1

Problem is not with the index name but the above properly.

I will retest my scenario after renaming the index and then rolling over.

By the way, thanks again for the prompt reply.