Index Alias stopped receiving data

[rueldu (GR)]

Hello, i need help. This is my case:

I am receiving flow data from two firewalls to the logstash and indexing with the names:
Branch1= Index1
Branch2= Index2

Now I have created an index alias:
AliasIndex = Branch1 + Branch2

and everything worked great until yesterday just at 7 PM exactly I stop receiving data from my Aliasindex. Then I went back to delete the aliasindex and index it again and it started to work.

Today is the same problem, just at 7 PM I stop receiving data in my INDEXALIAS

and I do not know how to solve this problem.

It should be noted that Index1 and Index2 continue to receive data without any problem.

Thank for the help.

[Christian_Dahlqvist]

I am not sure I understand your scenario fully as you have masked the index names. As far as I recall, an alias can only be.indexed into if it has a one-to-one mapping with an underlying index. If you automatically assign new indices to the alias, this could therefore cause it to turn read-only.

[rueldu (GR)]

Thank Christian for that. I already saw what the problem is, automatically the alias does not add the new generated indexes, so I have to add them to the manually >.<

Thanks.