I have EFK stack in Kubernetes, fluentd is responsible for sending application logs to elasticsearch and the index is in this format [ logstash-%Y-%m-%d ] so it creates a new index every day. I have created Index lifecycle management which moves the logs to warm phase after 15 days but index are failing in check-rollover-ready step with the below error.
illegal_argument_exception: rollover target [log-alias] does not point to a write index
How to resolve this error?
I have attached the index lifecycle policy and Index template below. Any help is appreciated. Thanks in advance.
**Index Lifecycle policy**
{
"prd-index-policy": {
"version": 4,
"modified_date": "2023-08-11T09:46:07.579Z",
"policy": {
"phases": {
"warm": {
"min_age": "2d",
"actions": {
"set_priority": {
"priority": 50
}
}
},
"delete": {
"min_age": "45d",
"actions": {
"delete": {
"delete_searchable_snapshot": true
},
"wait_for_snapshot": {
"policy": "BIWeek-Snapshots"
}
}
},
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "2d",
"max_primary_shard_size": "50gb"
},
"set_priority": {
"priority": 100
}
}
}
}
},
"in_use_by": {
"indices": [
"logstash-2023.08.12",
"logstash-2023.08.13",
"logstash-2023.08.14",
"logstash-2023-08-09",
"logstash-2023-08-08",
"logstash-2023-07-26",
"logstash-2023-08-14",
"logstash-2023-07-03",
"logstash-2023-08-13",
"logstash-2023-08-12",
"logstash-2023-07-01",
"logstash-2023-08-11",
"logstash-2023-08-10"
],
"data_streams": [],
"composable_templates": [
"logstash-template"
]
}
}
}
**Index template**
{
"index_templates": [
{
"name": "logstash-template",
"index_template": {
"index_patterns": [
"logstash-*"
],
"template": {
"settings": {
"index": {
"lifecycle": {
"name": "prd-index-policy",
"rollover_alias": "log-alias"
}
}
},
"aliases": {
"log-alias": {}
}
},
"composed_of": [],
"priority": 200
}
}
]
}