Illegal_argument_exception: rollover target [log-alias] does not point to a write index

I have EFK stack in Kubernetes, fluentd is responsible for sending application logs to elasticsearch and the index is in this format [ logstash-%Y-%m-%d ] so it creates a new index every day. I have created Index lifecycle management which moves the logs to warm phase after 15 days but index are failing in check-rollover-ready step with the below error.

illegal_argument_exception: rollover target [log-alias] does not point to a write index

How to resolve this error?
I have attached the index lifecycle policy and Index template below. Any help is appreciated. Thanks in advance.

**Index Lifecycle policy**
{
  "prd-index-policy": {
    "version": 4,
    "modified_date": "2023-08-11T09:46:07.579Z",
    "policy": {
      "phases": {
        "warm": {
          "min_age": "2d",
          "actions": {
            "set_priority": {
              "priority": 50
            }
          }
        },
        "delete": {
          "min_age": "45d",
          "actions": {
            "delete": {
              "delete_searchable_snapshot": true
            },
            "wait_for_snapshot": {
              "policy": "BIWeek-Snapshots"
            }
          }
        },
        "hot": {
          "min_age": "0ms",
          "actions": {
            "rollover": {
              "max_age": "2d",
              "max_primary_shard_size": "50gb"
            },
            "set_priority": {
              "priority": 100
            }
          }
        }
      }
    },
    "in_use_by": {
      "indices": [
        "logstash-2023.08.12",
        "logstash-2023.08.13",
        "logstash-2023.08.14",
        "logstash-2023-08-09",
        "logstash-2023-08-08",
        "logstash-2023-07-26",
        "logstash-2023-08-14",
        "logstash-2023-07-03",
        "logstash-2023-08-13",
        "logstash-2023-08-12",
        "logstash-2023-07-01",
        "logstash-2023-08-11",
        "logstash-2023-08-10"
      ],
      "data_streams": [],
      "composable_templates": [
        "logstash-template"
      ]
    }
  }
}
**Index template**
{
  "index_templates": [
    {
      "name": "logstash-template",
      "index_template": {
        "index_patterns": [
          "logstash-*"
        ],
        "template": {
          "settings": {
            "index": {
              "lifecycle": {
                "name": "prd-index-policy",
                "rollover_alias": "log-alias"
              }
            }
          },
          "aliases": {
            "log-alias": {}
          }
        },
        "composed_of": [],
        "priority": 200
      }
    }
  ]
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.