Index Lifecycle error and index size is huge

Elastic Stack Elasticsearch
1

Index lifecycle management

Index lifecycle error

illegal_argument_exception: index.lifecycle.rollover_alias [packetbeat-7.0.0-ilm-00000n] does not point to index [packetbeat-7.0.0-ilm]

I have been getting the above error.

Name of index: packetbeat-7.0.0-ilm

Extract from settings summary:
"index.blocks.read_only_allow_delete": "false",
"index.priority": "1",
"index.write.wait_for_active_shards": "1",
"index.lifecycle.name": "packetbeat-7.0.0",
"index.lifecycle.rollover_alias": "packetbeat-7.0.0-ilm-00000n",
"index.mapping.total_fields.limit": "10000",

Please advice what should I do now.

The file size is approaching 800GB since the file could not be recycle.

Thank you.

Regards
Alan

2

Welcome to our community! :smiley:

What does your ILM policy look like?

3

My policy [packetbeat-7.0.0] looked like

{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "150d",
"max_size": "50gb"
}
}
},
"delete": {
"min_age": "150d",
"actions": {
"delete": {}
}
}
}
}
}

4

Is that it? It's missing all the alias and index section.

Please also format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you :slight_smile:

5

Hi,
I am new to ELK and following was extracted from my index file: packetbeat-7.0.0-ilm settings when I select "edit settings" on the index file

{
"index.blocks.read_only_allow_delete": "false",
"index.priority": "1",
"index.write.wait_for_active_shards": "1",
"index.lifecycle.name": "packetbeat-7.0.0",
"index.lifecycle.rollover_alias": "packetbeat-7.0.0-ilm-00000n",
"index.mapping.total_fields.limit": "10000",
"index.refresh_interval": "5s",
"index.query.default_field": [
"message",
"tags",
"agent.ephemeral_id",
...
.....}

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.