ILM policy for .monitoring indexes

[dabo (Dane Bozic)]

Hi, How do I properly set up an ILM policy for .monitoring-* indexes?

• When I create a policy and add it to the index templates I get some error about rollover_alias
• Then when I add rollover alias and I get another error that it doesn't point to that index
• Then I add alias to the index template (that matches the rollover alias), then there is another error that it is not pointing to a write index

So basically I should not add alias to the template but kickstart the index with alias and as a write index. But how to do that when indexes are already existing?

[dosant (Anton Dosov)]

This seems very helpful:
Ilm policy on system index - #2 by jakelandis

And for the reference issue to have ilm for monitoring indices out of the box: Use ILM to manage internal indices · Issue #38470 · elastic/elasticsearch · GitHub

[dabo (Dane Bozic)]

Thanks you for help.
I tried suggested and it didn't help.

I created:

PUT _template/.monitoring
{
  "order": 10,
  "index_patterns": [".monitoring-*"],
  "settings": {
    "index.lifecycle.name": ".monitoring"
  }
}

Now getting illegal_argument_exception: index.lifecycle.rollover_alias [metricbeat-7.4.2] does not point to index [metricbeat-7.4.2-2021.10.01] on all .monitoring indexes.

If I now try to add rollover alias then I guess I would be back to the issue described above.

Any idea what I'm doing wrong?
Should I revers the order of templates? My "monitoring" template has order:10 and other default monitoring templates all have order:0.

Kind regards,
Dane