Index Alias stopped receiving data

Elastic Stack Elasticsearch
1

Hello, i need help. This is my case:

I am receiving flow data from two firewalls to the logstash and indexing with the names:
Branch1= Index1
Branch2= Index2

53%20PM
Screen Shot 2018-12-06 at 10.06.53 PM.png2048×726 168 KB

Now I have created an index alias:
AliasIndex = Branch1 + Branch2

and everything worked great until yesterday just at 7 PM exactly I stop receiving data from my Aliasindex. Then I went back to delete the aliasindex and index it again and it started to work.

Today is the same problem, just at 7 PM I stop receiving data in my INDEXALIAS

07%20PM
Screen Shot 2018-12-06 at 10.17.07 PM.png2184×832 278 KB

and I do not know how to solve this problem.

It should be noted that Index1 and Index2 continue to receive data without any problem.

Thank for the help.

2

I am not sure I understand your scenario fully as you have masked the index names. As far as I recall, an alias can only be.indexed into if it has a one-to-one mapping with an underlying index. If you automatically assign new indices to the alias, this could therefore cause it to turn read-only.

3

Thank Christian for that. I already saw what the problem is, automatically the alias does not add the new generated indexes, so I have to add them to the manually >.<

Thanks.