ILM policy not kicking in for index template

[sz7443 (Standa)]

Hi all,

I seek help with problem of ILM not being applied. I am missing a bit of configuration, but I don't see which one.

I have:

• ILM policy that should delete data after 4 hours
• ILM Policy being applied to the index template meeting the names of 2 indexes where deletion should already occur days ago (see the definition and the error below)
  Settings for index template:

{
  "index": {
    "lifecycle": {
      "name": "4-hours-retention",
      "rollover_alias": "ilm-winlogbeat-rollover"
    },
    "number_of_shards": "1",
    "number_of_replicas": "0"
  }
}

Settings set manually to the index template covering the indices in scope:

PUT _index_template/winlogbeat_
{
  "index_patterns":["winlogbeat*"],               
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0,
      "index.lifecycle.name": "4-hours-retention",      
      "index.lifecycle.rollover_alias": "ilm-winlogbeat-rollover"    
    }
  }
}

... and if I check the ILM "health" of the indices:

GET winlogbeat-*/_ilm/explain

I get this error about rollover_alias:

 "setting [index.lifecycle.rollover_alias] for index [winlogbeat-2022.06] is empty or not defined"

... which I deem odd, because I thought I am doing that with exactly this snippet that was accepted by ES:

"index.lifecycle.rollover_alias": "ilm-winlogbeat-rollover"    

ElasticSearch/Kibana version: 8.2.2
Logstash version: 7.6

Thank you in advance pointing out what am I missing, take care.