# ILM failing for rollover for Wazuh module / data

**URL:** https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781
**Category:** Elasticsearch
**Tags:** ilm-index-lifecycle-management
**Created:** [December 14, 2021, 11:10am UTC](https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781 "2021-12-14T11:10:19Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![Atul\_Chadha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_chadha/32/75469_2.png) [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)
#### Post date: [December 15, 2021, 3:38pm UTC](https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781/7 "2021-12-15T15:38:06Z")

</div>

@stephenb Thank you for the update, i tried to update the alias and recreated the index to match todays date.

I am getting a different error this time "` "reason" : "index name [wazuh-alerts-4.x-2021.12.15] does not match pattern '^.*-\\d+$'"`

I see similar issue raised in the below post.

> [@Using rollover got error](https://discuss.elastic.co/t/using-rollover-got-error/84869):
>
> Hi, I just created an alias which name is "squid-log-alias" for my index "squid-log", and when I setup rollover API and I got the error: POST /squid-log-alias/\_rollover { "conditions":{ "max\_age": "7d", "max\_docs": 1000 } } { "error": { "root\_cause": [{ "type": "illegal\_argument\_exception", "reason": "index name [squid-log] does not match pattern '^.-\d+$'" } ], "type": "illegal\_argument\_exception", "reason": "index name [squid-log] does not match pattern '^.-\d+$'" }, "sta…

Do we need the increment number after the index to rollover ? I am fine to clear out the settings and start fresh if that helps.

---

_[View the full topic](https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781)._