Filebeat Indexes, Aliases and Errors

[mhare (Michael)]

I am running ElasticStack 7.13.4 with Filebeat on Windows 10

I am ingesting several types of logs with Filebeat and wanted to put each of them into their own Index.

In filebeat I created an input as

#-------------------------------
# H00
- type: log

  enabled: true

  fields:
    logext: H00
    logtype: history

  paths:
    - C:\Log_file\History\*.H00

  encoding : utf-16

#-------------------------------

Later I created an output

#-------------------------------
  pipelines:
    - pipeline: log_history_h00_pipeline
      when.equals:
        fields.logext: H00

  indices:
    - index: "log-history-H00-%{+yyyy.MM.dd}"
      when.equals:
        fields.logext: H00

#-------------------------------

Seemed to work, but eventually I get an error message

illegal_argument_exception: index.lifecycle.rollover_alias [log-history-h00] does not point to index [log-history-h00-2021.10.03]

Investagating, I added this

#-------------------------------
POST /_aliases
{
"actions": [
    {
"add": {
"index": "log-history-h00-2021.10.03",
"alias": "log-history-h00",
"is_write_index": true
      }
    }
  ]
}
#-------------------------------

Which seemed to clear the issues until later I got this

illegal_argument_exception: index name [log-history-h00-2021.10.03] does not match pattern '^.*-\d+$'

Somewhere I must have made a wrong turn.

Can someone please help with this?

Thank you!

Michael

[mhare (Michael)]

I might mention this is how I am creating the index template

PUT _index_template/log-history-h00
{
  "index_patterns": ["log-history-h00*"],
  "priority": 1,
  "template": {
    "settings": {
      "number_of_shards": 1,
      "index": {
        "lifecycle": {
          "name": "my-ilm-policy",
          "rollover_alias": "log-history-h00"
        }
      }
    }
  }
}