# ILM alias does not point to index

**URL:** <https://discuss.elastic.co/t/ilm-alias-does-not-point-to-index/238567>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [June 24, 2020, 10:46pm UTC](https://discuss.elastic.co/t/ilm-alias-does-not-point-to-index/238567 "2020-06-24T22:46:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![craigothy](https://avatars.discourse-cdn.com/v4/letter/c/258eb7/32.png) [@craigothy](https://discuss.elastic.co/u/craigothy)\
**Post date:** [June 24, 2020, 10:46pm UTC](https://discuss.elastic.co/t/ilm-alias-does-not-point-to-index/238567/1 "2020-06-24T22:46:08Z")

</div>

Can someone explain why I am getting the following error regarding the default builtin ILM policy. I've seen this for different beats (winlogbeat,packetbeat,filebeat). They all go into an "error" state. I've basically just done a fresh install of winlogbeat for example. Then, before starting the service, I run a setup index-management which loads the default template and ILM policy. I start collecting documents and then I get the following error related to ILM. Any ideas on the cause here or how to troubleshoot? Thank you.

`illegal_argument_exception: index.lifecycle.rollover_alias [packetbeat-7.8.0] does not point to index [packetbeat-7.8.0-2020.06.24]`

---

<div class="post-metadata">

**Author:** ![yingtaojuzi](https://avatars.discourse-cdn.com/v4/letter/y/9de0a6/32.png) [@yingtaojuzi](https://discuss.elastic.co/u/yingtaojuzi)\
**Post date:** [June 30, 2020, 12:55am UTC](https://discuss.elastic.co/t/ilm-alias-does-not-point-to-index/238567/2 "2020-06-30T00:55:35Z")

</div>

I have the same issue when I use fluentd to collect logs, it's really weird. it already blocked me three days.

I am really curious about the ILM working procedure.

how does the index template handle the index patterns, since I already defined the patterns logstash-\* in the template, does that means all the indices with the prefix logstash can be managed by the index template

but what confused me is I got the logstash-2020.06.29, 2020.06.30 those index each day, the index template does not manage those.

I followed the doc [https://www.elastic.co/guide/en/elasticsearch/reference/7.8/set-up-lifecycle-policy.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.8/set-up-lifecycle-policy.html) to create the policy, the index template, and then the initial index.

and for the fluentd, I use the latest image version fluent/fluentd-kubernetes-daemonset:v1.11-debian-elasticsearch7-1, it's the default settings when output the logs to elasticsearch.

if I can not use ILM to manage the index like the index logstash-2020.06.29 logstash-2020.06.30, does that mean I need to find another way to delete those index after a specific days.

it's really frustrating.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2020, 12:55am UTC](https://discuss.elastic.co/t/ilm-alias-does-not-point-to-index/238567/3 "2020-07-28T00:55:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.