ILM Policy Errors When Created Via Kibana

[msauter]

Hello.

New to Elastic and new to this forum. Had a question related to Index Lifecycle Policy. I created 2 different ILPs via the Kibana GUI. I won't put any screen shots of it, but was able to create them w/o problem. Later I assigned each to a different index (and, accordingly, assigned an alias to each one as part of the assignment): one index tied to auditbeat and the other tied to packetbeat.

We are on 6.7 but heading to 7.4.

The ILM policies were both in place for a short time and the phases for both showed hot, but then erred with the message (only showing for the index tied to auditbeat):

illegal argument_exception:index.lifecycle.rollover_alias [auditbeat67] does not point to index [auditbeat-6.7.0-2019.51]

I went into the Development Tools tab of Kibana and ran this:
PUT auditbeat-6.7.0-2019.51/_ilm/retry
and received "acknowledged: true" and all seemed ok for a few minutes and then the

The index name and alias name match what I see in the Kibana GUI under Index Management and both indexes continue to ingest new documents. I guess I don't fully understand the error and cannot find helps in the Elastic documentation. The other thing that puzzles me is that I created and assigned these policies via the Kibana GUI - not using the API or putting the logic in the index template file (that will come later), so operator error is greatly reduced per se in this case.

Any help is greatly appreciated.

Regards,

Matt

[rugenl (Len Rugen)]

I don't have access to check what I think I remember, but do the ingesting indexes have is_write_alias: true?

[msauter]

Well - that is a great question. I knew I had to set is_write_alias: true, but never saw where to do that in the Kibana GUI. Maybe it is set that way implicitly through the course of setting all of the ILM up in Kibana, but I sure don't know how or where.