Filebeat index ILM error

Elastic Stack Beats
,
1

Blockquote

Hi Team ,

We are getting below error in elasticsearch ILM error :

Blockquote

illegal_argument_exception: index.lifecycle.rollover_alias [filebeat-7.17.1] does not point to index [filebeat-7.17.1-o365-2022.10.06]illegal_argument_exception: index.lifecycle.rollover_alias [filebeat-7.17.1] does not point to index [filebeat-7.17.1-o365-2022.10.06]

Blockquote

We are shipping data from filebeats -> elasticsearch.
We are not using Logstash in between.

The data is flowing from filebeat to elasticsearch enabled by modules (ex: o365).
This is the output configuration provided in filebeat.yml .However alias is not getting created which cause error in ILM.

Output section:
output.elasticsearch:

Array of hosts to connect to.

hosts: ["10.x.x.x:9200","10.x.x.x:9200","10.x.x.x:9200", "10.x.x.x:9200"]
indices:

- index: "filebeat-%{[agent.version]}-o365-%{+yyyy.MM.dd}"
  when.contains:
    event.module: "o365"
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.