# ILM elasticsearch not working

**URL:** <https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [November 6, 2022, 3:24pm UTC](https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263 "2022-11-06T15:24:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_96](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@alex\_96](https://discuss.elastic.co/u/alex_96)\
**Post date:** [November 6, 2022, 3:24pm UTC](https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263/1 "2022-11-06T15:24:53Z")

</div>

Such a question, I read the manual and I seem to have done everything right, but I still get an error for indices, I use the wazuh template and add the following to it:

```auto
{
  "order": 0,
  "index_patterns": [
    "wazuh-alerts-4.x-*",
    "wazuh-archives-4.x-*"
  ],
  "settings": {
    "index.refresh_interval": "5s",
    "index.number_of_shards": "3",
    "index.number_of_replicas": "0",
    "index.auto_expand_replicas": "0-1",
    "index.lifecycle.name": "wazuh_ilm",
    "index.lifecycle.rollover_alias": "wazuh-alerts-4.x",
    "index.mapping.total_fields.limit": 10000,

```

then restart filebeat  
My wazuh\_ilm:

```auto
PUT _ilm/policy/wazuh_ilm
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "set_priority": {
            "priority": 100
          },
          "rollover": {
            "max_age": "1d"
          }
        }
      },
      "warm": {
        "min_age": "5d",
        "actions": {
          "set_priority": {
            "priority": 50
          }
        }
      },
      "delete": {
        "min_age": "7d",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": true
          }
        }
      }
    }
  }
}

```

And after a while I get an error:

> illegal\_argument\_exception: setting [index.lifecycle.rollover\_alias] for index [wazuh-alerts-4.x-2022.11.02] is empty or not defined

And when I add a template to ilm in the field "linked index templates" I see 0

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 6, 2022, 3:51pm UTC](https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263/2 "2022-11-06T15:51:25Z")

</div>

This seems a duplicate of your other [post](https://discuss.elastic.co/t/correct-understanding-of-aliases-in-elasticsearch/318126).

Please, avoid creating duplicate posts.

---

<div class="post-metadata">

**Author:** ![alex\_96](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@alex\_96](https://discuss.elastic.co/u/alex_96)\
**Post date:** [November 6, 2022, 4:06pm UTC](https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263/3 "2022-11-06T16:06:03Z")

</div>

I marked the post to be deleted.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2022, 4:06pm UTC](https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263/4 "2022-12-04T16:06:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.