ILM policy not kicking in for index template

Hi all,

I seek help with problem of ILM not being applied. I am missing a bit of configuration, but I don't see which one.

I have:

  • ILM policy that should delete data after 4 hours
  • ILM Policy being applied to the index template meeting the names of 2 indexes where deletion should already occur days ago (see the definition and the error below)
    Settings for index template:
  "index": {
    "lifecycle": {
      "name": "4-hours-retention",
      "rollover_alias": "ilm-winlogbeat-rollover"
    "number_of_shards": "1",
    "number_of_replicas": "0"

Settings set manually to the index template covering the indices in scope:

PUT _index_template/winlogbeat_
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0,
      "": "4-hours-retention",      
      "index.lifecycle.rollover_alias": "ilm-winlogbeat-rollover"    

... and if I check the ILM "health" of the indices:

GET winlogbeat-*/_ilm/explain

I get this error about rollover_alias:

 "setting [index.lifecycle.rollover_alias] for index [winlogbeat-2022.06] is empty or not defined"

... which I deem odd, because I thought I am doing that with exactly this snippet that was accepted by ES:

"index.lifecycle.rollover_alias": "ilm-winlogbeat-rollover"    

ElasticSearch/Kibana version: 8.2.2
Logstash version: 7.6

Thank you in advance pointing out what am I missing, take care.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.