after trying to figure out some stuff about ILM i need some help now.
I have about 400 Cisco-Devices sending their logs to a syslog-ng server from where they are send to Elasticsearch via Filebeat / Logstash.
The logs on the syslogserver are rotated every day at 0:00 UTC and elasticsearch indexing the logs as
and so on.
I have followed this tutorial to create a ILM : Tutorial: Automate rollover with ILM | Elasticsearch Guide [8.3] | Elastic and usesd the 90-days-default ILM
I did the folowing steps:
- Create the index template
- create initial index
- Start Filebeat and Logstash to start loading the logs into elasticsearch
But it doesnt seems to work at all cause im getting the folowing error
Index lifecycle error
illegal_argument_exception: index.lifecycle.rollover_alias [cisco-switch] does not point to index [cisco-switch-2022.07.27]
All i want is that indices older than 90ß days get deleted from the index .
Any help would be appreciated.
I'm not a professional, I have discovered those ILM last week and came across this problem too.
According to the documentation:
You should check your aliases with
_cat/aliases.. There I noticed that my first index didn't have the alias (despite the fact I use the
"is_write_index": true too).
One solution was to run:
- template (as you did)
- create the index (as you did)
PUTcisco-switch-000001/_alias/cisco-switch to link the alias to the index
It's just for the first index, then it's automatic.
I hope it will works for you too!
Can you share your ILM policy as well please.
thank you very much.
put _cat/aliases shows
.transform-notifications-read .transform-notifications-000002 - - - -
.kibana-event-log-8.3.2 .kibana-event-log-8.3.2-000001 - - - true
.preview.alerts-security.alerts-default .internal.preview.alerts-security.alerts-default-000059 - - - false
.kibana_task_manager_8.2.2 .kibana_task_manager_8.2.2_001 - - - -
.lists-default .lists-default-000001 - - - true
.preview.alerts-security.alerts-default .internal.preview.alerts-security.alerts-default-000060 - - - true
.kibana_task_manager .kibana_task_manager_8.3.2_001 - - - -
.kibana_task_manager_8.3.2 .kibana_task_manager_8.3.2_001 - - - -
.items-default .items-default-000001 - - - true
.kibana_8.2.2 .kibana_8.2.2_001 - - - -
.security .security-7 - - - -
cisco-switch cisco-switch-000001 - - - -
.kibana .kibana_8.3.2_001 - - - -
.kibana_8.3.2 .kibana_8.3.2_001 - - - -
.kibana-event-log-8.2.2 .kibana-event-log-8.2.2-000002 - - - false
.kibana-event-log-8.2.2 .kibana-event-log-8.2.2-000001 - - - false
cisco-asa cisco-asa-000001 - - - -
.kibana-event-log-8.2.2 .kibana-event-log-8.2.2-000003 - - - true
but cisco_switch-2022.07.26, cisco-switch-2022.07.27 and cisco-switch2022.07.28 are not listed there, same for cisco-asa-2022.07.xx
somehow the template seems to not add the aliases to the new created indices and i keep getting the error.
@warkolm im using the default ILM Policy 90-days-default that came with ELK-Stack without any changes to it, but here it is:
"description": "built-in ILM policy using the hot, warm, and cold phases with a retention of 90 days"
If you are sending data to time-based indices with date in the name you can not use rollover as part of ILM. The whole point of rollover is to have a single alias that you write to and let Elasticsearch roll over backing indices automatically based on size and age. This relies on you giving up control of exactly which data that go into which backing index.
You therefore have 2 options. The first is to use rollover and require you to write to the
cisco-switch alias instead of index names with date in the names.
If you instead prefer to write to indices in the form
cisco-switch-2022-07.26 you should remove rollover from the ILM policy.
You mean something like this should delete my indices when they become older than 90 days?
Yes, something like that.