ILM : illegal_argument_exception: source alias [elastiflow-3.4.1-alias] does not point to a write index

[mayer (Hans)]

Dear All,

My environment: ELK 6.6.1 with elastiflow 3.4.1

As disk space is limited I tried to setup an Index Lifecycle Policy. Initially I failed with the following type of error.
illegal_argument_exception: index.lifecycle.rollover_alias [.... ] does not point to index ...

Based on several postings I modified file /etc/logstash/elastiflow/templates/elastiflow.template.json
and add some lines almost at the end. This is the diff

28683,28687d28682
< },
< "aliases": {
< "elastiflow-3.4.1-alias": {
< "is_write_index": true
< }

Restarting logstash and waiting a day for the new index the original error message disappears.
Now I can apply an life-cycle policy and it offers me an "Index Rollover Alias"
But when I do so I get the following error after some minutes:

illegal_argument_exception: source alias [elastiflow-3.4.1-alias] does not point to a write index

Any idea how I can solve this issue ?

Kind regards
Hans

[mayer (Hans)]

Dear All,

for all who run into a similar problem. Here my work around. I run a cron job once a night where I delete the indices "manually" which are older than a week.

curl -X GET 'localhost:9200/_cat/indices?v' 2> /dev/null | grep elastiflow  | sort -r | awk '{ print $3 }' | tail +7 | while read INDEX
do
  curl -XDELETE "http://localhost:9200/$INDEX"
done

Kind regards
Hans