{
"error" : {
"root_cause" : [
{
"type" : "illegal_argument_exception",
"reason" : "duration cannot be negative, was given [-8402614]"
}
],
"type" : "illegal_argument_exception",
"reason" : "duration cannot be negative, was given [-8402614]",
"suppressed" : [
{
"type" : "illegal_state_exception",
"reason" : "Failed to close the XContentBuilder",
"caused_by" : {
"type" : "i_o_exception",
"reason" : "Unclosed object or array found"
}
}
]
},
"status" : 400
}
This ilm error is happening for .siem-signals-default-000010,.siem-signals-default-000011,.siem-signals-default-000012 indices. .siem-signals-default-000012 is the current index.
Other index is working fine GET .siem-signals-default-000009/_ilm/explain
Which can be negative and would cause the error above. Coincidentally, it appears that this was recently fixed on 8.x because the line has been changed to:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.