Index [filebeat-7.4.1-YYYY.MM.DD] is not the write index for alias [filebeat-7.4.1]

[rverchere (Remi)]

Hi,

After installation on 1 filebeat agent to a new 7.4.1 Elastic cluster, I have the following errors on my filebeat indices:

Index lifecycle error

illegal_argument_exception: index [filebeat-7.4.1-2019.11.04] is not the write index for alias [filebeat-7.4.1]

GET filebeat-7.4.1/_ilm/explain
    "filebeat-7.4.1-2019.11.04" : {
      "index" : "filebeat-7.4.1-2019.11.04",
      "managed" : true,
      "policy" : "filebeat-7.4.1",
      "lifecycle_date_millis" : 1572822004864,
      "age" : "14.03h",
      "phase" : "hot",
      "phase_time_millis" : 1572872508562,
      "action" : "rollover",
      "action_time_millis" : 1572822260874,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1572872508562,
      "phase_execution" : {
        "policy" : "filebeat-7.4.1",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "version" : 7,
        "modified_date_in_millis" : 1572870698729
      }
    }

But - for me - everything seems fine:

GET filebeat-7.4.1-2019.11.04/_alias
{
  "filebeat-7.4.1-2019.11.04" : {
    "aliases" : {
      "filebeat-7.4.1" : {
        "is_write_index" : false
      }
    }
  }
}

GET _alias/
[...]
 "filebeat-7.4.1-2019.11.04" : {
    "aliases" : {
      "filebeat-7.4.1" : {
        "is_write_index" : false
      }
    }
  }
[...]

GET _ilm/policy
[...]
  "filebeat-7.4.1" : {
    "version" : 7,
    "modified_date" : "2019-11-04T12:31:38.729Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        }
      }
    }
  }

When requesting for an ILM retry, the error disappear for a moment, but comes back after a while:

POST filebeat-7.4.1-2019.11.04/_ilm/retry
{
  "acknowledged" : true
}

Any idea?

[rverchere (Remi)]

My bad, using"index.lifecycle.indexing_complete": "true" to the failed indices and then retry the rollover fixes the issue (https://www.elastic.co/guide/en/elasticsearch/reference/7.x/skipping-rollover.html)