Hi,
My server restarted, so I restarted my Filebeat, ES and Kibana. Initially, filebeat was giving the error of no write index is defined for alias [filebeat-7.14.0]. So I resolved it by using the Update Index Aliases API (POST _aliases) to add the latest existing index filebeat-7.14.0-2022.10.08-001234 with alias filebeat-7.14.0, and setting is_write_index to True. The data is now writing to this index.
However, I previously have an Index Life Cycle Policy (named filebeat) that enables rollover when max age is 30 days and max index size is 50GB. The index size before writing to it was already just over 50GB, and 8.5 days old. Now that I'm writing to it, the index isn't rolling over, and it is already 650GB. I changed the rollover action to just 50GB, but the index is still growing.
When I checked GET <index name>/_ilm/explain, I don't see any error (managed: true), and the policy name is correct (filebeat). When I checked Index Management on Kibana, the index is one of the 8 linked to the policy.
Why is the rollover not working?