# How to fix Index Lifecycle Rollover Alias is empty or not defined

**URL:** <https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675>\
**Category:** Elasticsearch\
**Created:** [January 24, 2024, 1:16am UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675 "2024-01-24T01:16:31Z")\
**Posts on this page:** 12\
**Page:** 2

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 25, 2024, 11:01pm UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/21 "2024-01-25T23:01:12Z")

</div>

> [@roman-tasi](#):
>
> os-linux-2024.01.25

How did that index get created?

Did you change your log stash output to what I showed you?

Looks like you're still not using write alias in logstash.

Looks like you're still writing daily indices

So your output index should be using the write alias

index =\> "os-linux"

---

<div class="post-metadata">

**Author:** ![roman-tasi](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\
**Post date:** [January 25, 2024, 11:43pm UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/22 "2024-01-25T23:43:33Z")

</div>

I changed the output to be `index => "os-linux"`

However the new index (`os-linux`) seems to not be associated with any index lifecycle policy. Here is the top portion of the settings where the policy should be:

```auto
{
  "settings": {
    "index": {
      "routing": {
        "allocation": {
          "include": {
            "_tier_preference": "data_content"
          }
        }
      },
      "number_of_shards": "1",
      "provided_name": "os-linux",
      "creation_date": "1706226036921",
      "number_of_replicas": "1",
      "uuid": "shQ4er9QS-iWpnNjFDXDWw",
      "version": {
        "created": "7170999"
      }
    }
  },

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 26, 2024, 4:33am UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/23 "2024-01-26T04:33:26Z")

</div>

Hi @roman-tasi

Feel like we are going in circles a bit...

Create the template.

Create the bootstrap index

> [@stephenb](#):
>
> ```auto
> PUT /%3Cos-linux-%7Bnow%2Fd%7D-000001%3E
> {
> "aliases": {
> "os-linux": {
> "is_write_index": true
> }
> }
> }  
> 
> ```

Then set logstash to point to `os-linux` that should not create a new index

I am not sure what you are doing but it does not seem you are following the steps in order...

If the bootstrap index with the write alias is created the it will not create a new index with that name `os-linux` m.. it can not since the alias exists... it will write to the bootstrap index which matches the template which will have the ILM policy...

I suggested you read the documents that also share the steps.

---

<div class="post-metadata">

**Author:** ![roman-tasi](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\
**Post date:** [January 26, 2024, 9:29pm UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/24 "2024-01-26T21:29:56Z")

</div>

> [@stephenb](#):
>
> Create the template.
> 
> Create the bootstrap index
> 
> ```auto
> PUT /%3Cos-linux-%7Bnow%2Fd%7D-000001%3E
> {
> "aliases": {
> "os-linux": {
> "is_write_index": true
> }
> }
> }  
> 
> ```

After restarting and following these steps, I now have an index called `os-linux-2024.01.26-000001` associated with `os-linux-policy`. Hopefully it doesn't give a rollover alias error (I'll keep an eye on it).

---

<div class="post-metadata">

**Author:** ![roman-tasi](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\
**Post date:** [January 30, 2024, 12:40am UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/25 "2024-01-30T00:40:18Z")

</div>

@stephenb

`os-linux-2024.01.26-000001` still exists three days later and no new os-linux index has been created. All os-linux output logs are going into the `os-linux-2024.01.26-000001`. The current phase is `hot` and the current action is `rollover`. Keep in mind my `os-linux-policy` goes from `hot` phase to `cold` phase after 20 hours, then `delete` phase after 2 days.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 30, 2024, 12:49am UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/26 "2024-01-30T00:49:08Z")

</div>

Run

`GET /os-linux-2024.01.26-000001/_ilm/explain`

And

`GET _ilm/policy/os-linux-policy`

Show the complete results of both

And do you have a node with the role data\_cold?

---

<div class="post-metadata">

**Author:** ![roman-tasi](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\
**Post date:** [January 30, 2024, 12:57am UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/27 "2024-01-30T00:57:27Z")

</div>

@stephenb -

`GET /os-linux-2024.01.26-000001/_ilm/explain` :

```auto
{
  "indices" : {
    "os-linux-2024.01.26-000001" : {
      "index" : "os-linux-2024.01.26-000001",
      "managed" : true,
      "policy" : "os-linux-policy",
      "lifecycle_date_millis" : 1706303495029,
      "age" : "3.15d",
      "phase" : "hot",
      "phase_time_millis" : 1706303495228,
      "action" : "rollover",
      "action_time_millis" : 1706303495837,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1706303495837,
      "phase_execution" : {
        "policy" : "os-linux-policy",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "set_priority" : {
              "priority" : 100
            },
            "rollover" : {
              "max_primary_shard_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "version" : 1,
        "modified_date_in_millis" : 1705694441892
      }
    }
  }
}

```

`GET _ilm/policy/os-linux-policy` :

```auto
{
  "os-linux-policy" : {
    "version" : 1,
    "modified_date" : "2024-01-19T20:00:41.892Z",
    "policy" : {
      "phases" : {
        "cold" : {
          "min_age" : "20h",
          "actions" : {
            "set_priority" : {
              "priority" : 0
            }
          }
        },
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "set_priority" : {
              "priority" : 100
            },
            "rollover" : {
              "max_primary_shard_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "delete" : {
          "min_age" : "2d",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    },
    "in_use_by" : {
      "indices" : [
        "os-linux-2024.01.26-000001"
      ],
      "data_streams" : [],
      "composable_templates" : []
    }
  }
}

```

> [@stephenb](#):
>
> And do you have a node with the role data\_cold?

Can you explain how to find this?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 30, 2024, 3:42am UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/28 "2024-01-30T03:42:51Z")

</div>

Well first your max age for rollover is 30d so and currently the index is only 3+ days old and it is not 50 GB shards

> [@roman-tasi](#):
>
> ```auto
> hot" : {
> "min_age" : "0ms",
> "actions" : {
> "set_priority" : {
> "priority" : 100
> },
> "rollover" : {
> "max_primary_shard_size" : "50gb",
> "max_age" : "30d" < HERE
> }
> }
> },
> 
> ```

So the index will not rollover until 50GB or 30d days.

Then really important the _ **next phases are calculated from rollover** _

So right now your policy says cold 20h after rollover

Then delete 2 days after rollover

And your index has not even rolled over yet... Because it is not 50gb shard or 30 days old

So everything is working as expect but your policy is not right... You need to set the rollover properly...

Read this [here](https://www.elastic.co/guide/en/elasticsearch/reference/8.12/index-lifecycle-error-handling.html#_how_min_age_is_calculated)

Why don't you just set rollover to 1 day max the delete at 3 days ... Not sure what cold is doing for you....

Update the policy

Force rollover and it should start working

You can force rollover with

`POST os-linux/_rollover`

---

<div class="post-metadata">

**Author:** ![roman-tasi](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\
**Post date:** [February 2, 2024, 7:32pm UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/29 "2024-02-02T19:32:28Z")

</div>

@stephenb

Running `GET /os-linux-2024.01.30-000002/_ilm/explain` outputs:

```auto
{
  "indices" : {
    "os-linux-2024.01.30-000002" : {
      "index" : "os-linux-2024.01.30-000002",
      "managed" : true,
      "policy" : "os-linux-policy",
      "lifecycle_date_millis" : 1706729701942,
      "age" : "1.99d",
      "phase" : "cold",
      "phase_time_millis" : 1706802301657,
      "action" : "migrate",
      "action_time_millis" : 1706802301858,
      "step" : "check-migration",
      "step_time_millis" : 1706802302276,
      "step_info" : {
        "message" : "Waiting for all shard copies to be active",
        "shards_left_to_allocate" : -1,
        "all_shards_active" : false,
        "number_of_replicas" : 1
      },
      "phase_execution" : {
        "policy" : "os-linux-policy",
        "phase_definition" : {
          "min_age" : "20h",
          "actions" : {
            "set_priority" : {
              "priority" : 0
            }
          }
        },
        "version" : 3,
        "modified_date_in_millis" : 1706642876728
      }
    }
  }
}

```

Just wondering why it is `"Waiting for all shard copies to be active"`

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 2, 2024, 8:33pm UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/30 "2024-02-02T20:33:42Z")

</div>

> [@roman-tasi](#):
>
> Just wondering why it is `"Waiting for all shard copies to be active"`

No Clue .. .

Could be lots of reasons... You should open a separate topic.

Reasons could be ...  
You have no appropriate cold node.  
You do not have disk room?  
Something else...

`GET _cat/shards/os-linux-2024.01.30-000002`

Then, use that info to run... this on whatever shard is not allocated.

```auto
GET _cluster/allocation/explain
{
  "index": "os-linux-2024.01.25-000002",
  "shard": 0, 
  "primary": false <
}

```

Open a new thread with that info... not going to debug in this thread..

---

<div class="post-metadata">

**Author:** ![roman-tasi](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\
**Post date:** [February 4, 2024, 1:10am UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/31 "2024-02-04T01:10:54Z")

</div>

It managed to eventually delete itself later that day so I'll mark this thread as solved. Thanks for all the help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2024, 1:11am UTC](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675/32 "2024-03-03T01:11:49Z")

</div>

Closed on March 3, 2024, 1:11am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/how-to-fix-index-lifecycle-rollover-alias-is-empty-or-not-defined/351675.md?page=1)