# Help with simple ILM rollover configuration for existing index

**URL:** <https://discuss.elastic.co/t/help-with-simple-ilm-rollover-configuration-for-existing-index/338843>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [July 20, 2023, 4:33am UTC](https://discuss.elastic.co/t/help-with-simple-ilm-rollover-configuration-for-existing-index/338843 "2023-07-20T04:33:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stephen\_Joiner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephen_joiner/32/123678_2.png) [@Stephen\_Joiner](https://discuss.elastic.co/u/Stephen_Joiner)\
**Post date:** [July 20, 2023, 4:33am UTC](https://discuss.elastic.co/t/help-with-simple-ilm-rollover-configuration-for-existing-index/338843/1 "2023-07-20T04:33:22Z")

</div>

Hey everyone!

I have a super basic Elastic Stack set up in docker on my personal server. I am using Logstash to gather the logs of my non-elastic containers. The stack works great and has for years. The problem I'm running into is that I am unable to get ILM working. The elastic and logstash containers are bare-bones - pretty much all default settings files. I am managing the ILM stuff in Kibana on the same server. If I'm going about this totally the wrong way, please let me know what a more appropriate approach would be.

This is the pertinent info from error I'm getting:

```auto
"message": "policy [30-days-default] for index [logstash] failed on step [{\"phase\":\"hot\",\"action\":\"rollover\",\"name\":\"check-rollover-ready\"}]. Moving to ERROR step",
"error.stack_trace": "java.lang.IllegalArgumentException: index name [logstash] does not match pattern '^.*-\\d+$' ... etc.

```

By default, logstash created an index named `logstash` that is added in Kibana. This is the logstash output plugin I'm using:

```auto
output {
  elasticsearch { hosts => ["elasticsearch:9200"] }
}

```

I created an index template for it called `logstash_index_template` for the pattern `logstash*`:

```auto
{
  "template": {
    "settings": {
      "index": {
        "routing": {
          "allocation": {
            "include": {
              "_tier_preference": "data_content"
            }
          }
        }
      }
    },
    "aliases": {
      "logstash_alias": {}
    },
    "mappings": {}
  }
}

```

I added the alias "logstash\_alias" to the index to match the template.

I am using the `30-days-default` lifecycle policy with the goal of deleting documents older than 30 days. I applied this policy to the index.

So as far as I can tell, the rollover is failing because my index isn't using the indexname-xx format. I am not sure how to make this happen. I tried it with the alias being `logstash_alias-0001` but it still is targeting the index name itself. I tried renaming the index to `logstash-0001` but the original index just gets created again whenever a new document is written.

Is this a valid approach for my goal? I appreciate any help I can get on this.

Thank you!

---

<div class="post-metadata">

**Author:** ![coezdemir](https://avatars.discourse-cdn.com/v4/letter/c/7c8e57/32.png) [@coezdemir](https://discuss.elastic.co/u/coezdemir)\
**Post date:** [July 20, 2023, 2:45pm UTC](https://discuss.elastic.co/t/help-with-simple-ilm-rollover-configuration-for-existing-index/338843/2 "2023-07-20T14:45:01Z")

</div>

Hello,

[ILM Policy ES](https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-lifecycle-policy.html#:~:text=To%20create%20a%20lifecycle%20policy,policy%20to%20the%20Elasticsearch%20cluster.)

Please take a look at the above link, It feels like you are either missing some part of the complete configuration here. You might need to manually start your first write index, and have your rollover use the incremented index like the example shows.

It could be a pattern issue or a wrongly defined alias.

Regards.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2023, 2:45pm UTC](https://discuss.elastic.co/t/help-with-simple-ilm-rollover-configuration-for-existing-index/338843/3 "2023-08-17T14:45:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.