# If enable ILM in config file, then cannot set custom elastic output index

**URL:** <https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307>\
**Category:** Beats\
**Tags:** elastic-stack-monitoring, winlogbeat\
**Created:** [October 7, 2020, 4:27pm UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307 "2020-10-07T16:27:29Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonysue](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@tonysue](https://discuss.elastic.co/u/tonysue)\
**Post date:** [October 7, 2020, 4:27pm UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307/1 "2020-10-07T16:27:29Z")

</div>

setup.template.overwrite: true  
output.elasticsearch.index: "winlogbeat=%{[agent.version]}"-city-firm-hostname-%{+yyyy,MM,dd}-000001"  
setup.template.name: "winlogbeat"  
setup.template.pattern: "winlogbeat-\*"  
setup.ilm.overwrite: true  
setup.ilm.enabled: true \<\< ----- must be set to false to generate custom output.elasticsearch.index names?.

If I enable ILM per "setup.ilm.enable: true", then the output index is not generated on the stipulated name format "winlogbeat=%{[agent.version]}"-city-firm-hostname-%{+yyyy,MM,dd}-000001".

If setup.ilm.enabled: false, then there is no problem with the output index stipulated name format.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [October 8, 2020, 5:11am UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307/2 "2020-10-08T05:11:19Z")

</div>

Hello Tony,

with `setup.ilm.enabled: false` Elastic uses the config provided in `output.elasticsearch.index`. If you enable `setup.ilm.enabled`, Elastic starts using [setup.ilm.rollover\_alias](https://www.elastic.co/guide/en/beats/winlogbeat/current/ilm.html#setup-ilm-rollover_alias-option) and [setup.ilm.pattern](https://www.elastic.co/guide/en/beats/winlogbeat/current/ilm.html#setup-ilm-pattern-option).  
So, to achieve what you want you have to update your configuration(_untested_):

```auto
setup.ilm.rollover_alias: "winlogbeat-%{[agent.version]}-city-firm-hostname"
setup.ilm.pattern: "{now{+yyyy,MM,dd}}-000001"

```

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![tonysue](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@tonysue](https://discuss.elastic.co/u/tonysue)\
**Post date:** [October 8, 2020, 7:31am UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307/4 "2020-10-08T07:31:34Z")

</div>

Hi Wolfram,  
IIlegal\_argument\_exception: index.lifecycle.rollover\_alias [winlogbeat-7.9.2] does not point to index [winlogbeat-7.9.2-city-firm-hostname10-2020.10.08-000001] was rendered in Index Management.  
Some say I should not define Aliases in index templates which I have not. This error has occurred in 16 indices but not all. There are question with no solution in the listserv that I can see thus far.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [October 8, 2020, 7:55am UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307/5 "2020-10-08T07:55:46Z")

</div>

Hello Tony,

The old rollover alias `winlogbeat-7.9.2` was created using the old template and therefore collides with the new entries. I think you can delete the old rollover alias using the alias API as no new data should be coing to this alias after you have changed your Beats config.

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![tonysue](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@tonysue](https://discuss.elastic.co/u/tonysue)\
**Post date:** [October 8, 2020, 8:43am UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307/6 "2020-10-08T08:43:47Z")

</div>

> [@Wolfram\_Haussig](#):
>
> the old rollover alias

Thanks Wofram, Your recommendation worked for the first time, then something caused Elastic not picking up the index after an 15mins. When I reset my config. It sends me another error  
Exiting: resource 'winlogbeat-7.9.2' exists, but it is not an alias .  
Sorry for the series of issues on ilm which is causing me havoc.

---

<div class="post-metadata">

**Author:** ![tonysue](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@tonysue](https://discuss.elastic.co/u/tonysue)\
**Post date:** [October 8, 2020, 4:54pm UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307/7 "2020-10-08T16:54:08Z")

</div>

a bit more clarification, it should be 'winlogbeat-7.9.2-city-firm-host' exists, but it is not alias.

---

<div class="post-metadata">

**Author:** ![tonysue](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@tonysue](https://discuss.elastic.co/u/tonysue)\
**Post date:** [October 9, 2020, 6:36am UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307/8 "2020-10-09T06:36:53Z")

</div>

Thanks Wolfram, got it working after deleting the old indices as per advice and to ensure manually creating index alias through APIs too . Also manually creating the \_rollover index alias to resolve the interim error messages (don't know why the ilm GUI was not sufficient).

---

<div class="post-metadata">

**Author:** ![tonysue](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@tonysue](https://discuss.elastic.co/u/tonysue)\
**Post date:** [October 10, 2020, 5:45pm UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307/9 "2020-10-10T17:45:24Z")

</div>

Thanks Wolfram, corrected the setup.ilm.pattern: "{now{+yyyy,MM,dd}}-000001" to setup.ilm.pattern: "{now/M{YYYY.MM.dd}}-000001" in the winlogbeat.yml, which produced the right rollover\_alias "winlogbeat-7.9.2-city-firm-hostname10" appended with YYYY.MM.dd-000001

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2020, 7:45pm UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307/10 "2020-11-07T19:45:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.