I am having a very difficult time understanding the workflow with index aliases. I understand ILM as what it is doing with the indexes with shrinking shards, moving to warm/cold/frozen tiers and deleting after X amount of days/size/time but what I can't wrap my head around is the purpose of index aliases.
For example I have multiple policies with INDEX only that uses namespaces. This will automatically create new hidden indices with names such as .ds-logs-endpoint.events.library--- along with data streams. However these default index templates that come with elastic have NO aliases. So when I try to add a life cycle policy to them, they show a warning:
Index has no aliases
Policy 7-days-default is configured for rollover, but index .ds-.logs-endpoint.diagnostic.collection-datacenter-2022.05.12-000001 does not have an alias, which is required for rollover.
I figure I wouldn't want to edit a default index template that comes with Elastic but even if I did what would I put as a index alias especially since namespaces are involved? What is the solution?