My server restarted, so I restarted my Filebeat, ES and Kibana. Initially, filebeat was giving the error of
no write index is defined for alias [filebeat-7.14.0]. So I resolved it by using the Update Index Aliases API (
POST _aliases) to add the latest existing index
filebeat-7.14.0-2022.10.08-001234 with alias
filebeat-7.14.0, and setting
True. The data is now writing to this index.
However, I previously have an Index Life Cycle Policy (named
filebeat) that enables rollover when max age is 30 days and max index size is 50GB. The index size before writing to it was already just over 50GB, and 8.5 days old. Now that I'm writing to it, the index isn't rolling over, and it is already 650GB. I changed the rollover action to just 50GB, but the index is still growing.
When I checked
GET <index name>/_ilm/explain, I don't see any error (
managed: true), and the policy name is correct (
filebeat). When I checked Index Management on Kibana, the index is one of the 8 linked to the policy.
Why is the rollover not working?