New to Elastic and new to this forum. Had a question related to Index Lifecycle Policy. I created 2 different ILPs via the Kibana GUI. I won't put any screen shots of it, but was able to create them w/o problem. Later I assigned each to a different index (and, accordingly, assigned an alias to each one as part of the assignment): one index tied to auditbeat and the other tied to packetbeat.
We are on 6.7 but heading to 7.4.
The ILM policies were both in place for a short time and the phases for both showed hot, but then erred with the message (only showing for the index tied to auditbeat):
illegal argument_exception:index.lifecycle.rollover_alias [auditbeat67] does not point to index [auditbeat-6.7.0-2019.51]
I went into the Development Tools tab of Kibana and ran this:
and received "acknowledged: true" and all seemed ok for a few minutes and then the
The index name and alias name match what I see in the Kibana GUI under Index Management and both indexes continue to ingest new documents. I guess I don't fully understand the error and cannot find helps in the Elastic documentation. The other thing that puzzles me is that I created and assigned these policies via the Kibana GUI - not using the API or putting the logic in the index template file (that will come later), so operator error is greatly reduced per se in this case.
Any help is greatly appreciated.