Index Lifecycle error and index size is huge

[alankong (Alan)]

Index lifecycle management

Index lifecycle error

illegal_argument_exception: index.lifecycle.rollover_alias [packetbeat-7.0.0-ilm-00000n] does not point to index [packetbeat-7.0.0-ilm]

I have been getting the above error.

Name of index: packetbeat-7.0.0-ilm

Extract from settings summary:
"index.blocks.read_only_allow_delete": "false",
"index.priority": "1",
"index.write.wait_for_active_shards": "1",
"index.lifecycle.name": "packetbeat-7.0.0",
"index.lifecycle.rollover_alias": "packetbeat-7.0.0-ilm-00000n",
"index.mapping.total_fields.limit": "10000",

Please advice what should I do now.

The file size is approaching 800GB since the file could not be recycle.

Thank you.

Regards
Alan

[warkolm (Mark Walkom)]

Welcome to our community!

What does your ILM policy look like?

[alankong (Alan)]

My policy [packetbeat-7.0.0] looked like

{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "150d",
"max_size": "50gb"
}
}
},
"delete": {
"min_age": "150d",
"actions": {
"delete": {}
}
}
}
}
}

[warkolm (Mark Walkom)]

Is that it? It's missing all the alias and index section.

Please also format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you

[alankong (Alan)]

Hi,
I am new to ELK and following was extracted from my index file: packetbeat-7.0.0-ilm settings when I select "edit settings" on the index file

{
"index.blocks.read_only_allow_delete": "false",
"index.priority": "1",
"index.write.wait_for_active_shards": "1",
"index.lifecycle.name": "packetbeat-7.0.0",
"index.lifecycle.rollover_alias": "packetbeat-7.0.0-ilm-00000n",
"index.mapping.total_fields.limit": "10000",
"index.refresh_interval": "5s",
"index.query.default_field": [
"message",
"tags",
"agent.ephemeral_id",
...
.....}