ILM alias does not point to index

Elastic Stack Elasticsearch
1

Can someone explain why I am getting the following error regarding the default builtin ILM policy. I've seen this for different beats (winlogbeat,packetbeat,filebeat). They all go into an "error" state. I've basically just done a fresh install of winlogbeat for example. Then, before starting the service, I run a setup index-management which loads the default template and ILM policy. I start collecting documents and then I get the following error related to ILM. Any ideas on the cause here or how to troubleshoot? Thank you.

illegal_argument_exception: index.lifecycle.rollover_alias [packetbeat-7.8.0] does not point to index [packetbeat-7.8.0-2020.06.24]

2

I have the same issue when I use fluentd to collect logs, it's really weird. it already blocked me three days.

I am really curious about the ILM working procedure.

how does the index template handle the index patterns, since I already defined the patterns logstash-* in the template, does that means all the indices with the prefix logstash can be managed by the index template

but what confused me is I got the logstash-2020.06.29, 2020.06.30 those index each day, the index template does not manage those.

I followed the doc https://www.elastic.co/guide/en/elasticsearch/reference/7.8/set-up-lifecycle-policy.html to create the policy, the index template, and then the initial index.

and for the fluentd, I use the latest image version fluent/fluentd-kubernetes-daemonset:v1.11-debian-elasticsearch7-1, it's the default settings when output the logs to elasticsearch.

if I can not use ILM to manage the index like the index logstash-2020.06.29 logstash-2020.06.30, does that mean I need to find another way to delete those index after a specific days.

it's really frustrating.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.