# Index \[filebeat-7.4.1-YYYY.MM.DD\] is not the write index for alias \[filebeat-7.4.1\]

**URL:** https://discuss.elastic.co/t/index-filebeat-7-4-1-yyyy-mm-dd-is-not-the-write-index-for-alias-filebeat-7-4-1/206405
**Category:** Elasticsearch
**Tags:** ilm-index-lifecycle-management
**Created:** [November 4, 2019, 1:01pm UTC](https://discuss.elastic.co/t/index-filebeat-7-4-1-yyyy-mm-dd-is-not-the-write-index-for-alias-filebeat-7-4-1/206405 "2019-11-04T13:01:07Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![rverchere](https://avatars.discourse-cdn.com/v4/letter/r/dbc845/32.png) [@rverchere](https://discuss.elastic.co/u/rverchere)
#### Post date: [November 4, 2019, 1:01pm UTC](https://discuss.elastic.co/t/index-filebeat-7-4-1-yyyy-mm-dd-is-not-the-write-index-for-alias-filebeat-7-4-1/206405/1 "2019-11-04T13:01:08Z")

</div>

Hi,

After installation on 1 filebeat agent to a new 7.4.1 Elastic cluster, I have the following errors on my filebeat indices:

```auto
Index lifecycle error

illegal_argument_exception: index [filebeat-7.4.1-2019.11.04] is not the write index for alias [filebeat-7.4.1]

```

```auto
GET filebeat-7.4.1/_ilm/explain
    "filebeat-7.4.1-2019.11.04" : {
      "index" : "filebeat-7.4.1-2019.11.04",
      "managed" : true,
      "policy" : "filebeat-7.4.1",
      "lifecycle_date_millis" : 1572822004864,
      "age" : "14.03h",
      "phase" : "hot",
      "phase_time_millis" : 1572872508562,
      "action" : "rollover",
      "action_time_millis" : 1572822260874,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1572872508562,
      "phase_execution" : {
        "policy" : "filebeat-7.4.1",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        },
        "version" : 7,
        "modified_date_in_millis" : 1572870698729
      }
    }

```

But - for me - everything seems fine:

```auto
GET filebeat-7.4.1-2019.11.04/_alias
{
  "filebeat-7.4.1-2019.11.04" : {
    "aliases" : {
      "filebeat-7.4.1" : {
        "is_write_index" : false
      }
    }
  }
}

```

```auto
GET _alias/
[...]
 "filebeat-7.4.1-2019.11.04" : {
    "aliases" : {
      "filebeat-7.4.1" : {
        "is_write_index" : false
      }
    }
  }
[...]

```

```auto
GET _ilm/policy
[...]
  "filebeat-7.4.1" : {
    "version" : 7,
    "modified_date" : "2019-11-04T12:31:38.729Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "30d"
            }
          }
        }
      }
    }
  }

```

When requesting for an ILM retry, the error disappear for a moment, but comes back after a while:

```auto
POST filebeat-7.4.1-2019.11.04/_ilm/retry
{
  "acknowledged" : true
}

```

Any idea?

---

<div class="post-metadata">

### Author: ![rverchere](https://avatars.discourse-cdn.com/v4/letter/r/dbc845/32.png) [@rverchere](https://discuss.elastic.co/u/rverchere)
#### Post date: [November 5, 2019, 1:22pm UTC](https://discuss.elastic.co/t/index-filebeat-7-4-1-yyyy-mm-dd-is-not-the-write-index-for-alias-filebeat-7-4-1/206405/2 "2019-11-05T13:22:00Z")

</div>

My bad, using`"index.lifecycle.indexing_complete": "true"` to the failed indices and then retry the rollover fixes the issue ([https://www.elastic.co/guide/en/elasticsearch/reference/7.x/skipping-rollover.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/skipping-rollover.html))

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 3, 2019, 1:22pm UTC](https://discuss.elastic.co/t/index-filebeat-7-4-1-yyyy-mm-dd-is-not-the-write-index-for-alias-filebeat-7-4-1/206405/3 "2019-12-03T13:22:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.