Facing issues with ILM on auto indexes

I am playing with ILM on one index named as filebeat-7.17.8-2023.01.09. This is the auto index. i want to create ILM on this so i have created alias for this index.

curl -XPUT  'ip/filebeat-7.17.8-*/_alias/filebeat-0002-1'

With this my expectation is any new index created as

filebeat-7.17.8-2023.mm.dd should have filebeat-0002-1 as alias. But it is not working currently. Every time i have to create alias on the newer index and apply ILM.

Hi @rahul_sirugudi

I think You might have it slightly backwards :slight_smile:

Write alias is the generic name, it is also known as the rollover alias.
The specific index name is the concrete index

So yours would like something like this...

Then your filebeat would write to filebeat-7.17.8 and then when the index rolls over

Try this and you will see..

PUT filebeat-7.17.8-2023.01.09
{
  "aliases": {
    "filebeat-7.17.8":{
      "is_write_index": true 
    }
  }
}

POST filebeat-7.17.8/_rollover

correct me if i am wrong, from the above API we are creating index and the alias right? What if my indexes are already existing?