Illegal_argument_exception: index.lifecycle.rollover_alias [actions-logs] does not point to index [actions-logs]

Elastic Stack Kibana
1

Got a template with this

{
"index": {
"lifecycle": {
"name": "logstash-policy",
"rollover_alias": "actions-logs"
},
"number_of_replicas": "0"
}
}

Got index with name "actions-logs"

But at index "actiong-logs"

Index lifecycle error

illegal_argument_exception: index.lifecycle.rollover_alias [actions-logs] does not point to index [actions-logs]

Why is it "does not point to index" ?

I see at index settings

{
"settings": {
"index": {
"lifecycle": {
"name": "logstash-policy",
"rollover_alias": "actions-logs"
...

2

Hi,

In your case, you've set the rollover_alias to "actions-logs" in your index lifecycle policy. This means that you should have an index alias named "actions-logs" that points to your index.

However, from your message, it seems like "actions-logs" is the name of your index, not an alias. The rollover_alias should be an alias that points to the index, not the index name itself.

To resolve this issue, you need to create an alias named "actions-logs" that points to your index.

Regards

3

How to create the alias ?

4

Hi,

go to this link

regards

5

I missed "aliases" setting at kibana at the template settings.
So i use
index => "actions-logs-%{+YYYY.MM.dd}"
at my logstash.conf
then does rollover is mandatory action ?
I want to keep last 7 days and then remove indexes.
Thanks

6

Hi,

Rollover is not a mandatory action.

However, if you want to keep the last 7 days of data and then remove indices, you can achieve this by setting up an Index Lifecycle Management (ILM) policy without the rollover action. Here's an example of how you can do this:

PUT _ilm/policy/my_policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {}
      },
      "delete": {
        "min_age": "7d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

After creating the policy, you can apply it to your index template like this:

PUT _template/my_template
{
  "index_patterns": ["actions-logs-*"],
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0,
    "index.lifecycle.name": "my_policy",
    "index.lifecycle.rollover_alias": "actions-logs"
  }
}

Regards

1 Like
7
  1. At the kibana it's written that hot phase is required

image
image1535×214 16.2 KB

  1. If i turn off rollover and stop logstash, delete index, start logstash than my index creating with no mention of deleting.

image
image932×582 49.4 KB

my logstash.conf include this, if this is matter

index => "actions-logs-%{+YYYY.MM.dd}"

that's why i am asking does hot action required ? What could it be except than rolover ?

8

GET _ilm/policy/logstash-policy

{
"logstash-policy": {
"version": 15,
"modified_date": "2024-01-14T11:01:17.873Z",
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {}
},
"delete": {
"min_age": "7d",
"actions": {
"delete": {
"delete_searchable_snapshot": true
}
}
}
}
},
"in_use_by": {
"indices": [
"actions-logs-2024.01.14"
],
"data_streams": ,
"composable_templates": [
"actions-logs-alias",
"custom",
"actions-logs"
]
}
}
}

i see

    "delete": {
      "min_age": "7d",
      "actions": {
        "delete": {

Maybe I'm wrong to doubt. I just need it to create new index for every next day. Will it ?

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.