Index Lifecycle Management from Kibana UI not working


I am trying to implement index lifecycle management from Kibana UI. Note that I have already implemented X-Pack Security for Elasticsearch, Logstash and Kibana, but not for beats. Now I am facing weird problem. Below is my beats template in the ES cluster.

"filebeat" : {
"order" : 0,
"index_patterns" : [
"settings" : {
"index" : {
"lifecycle" : {
"name" : "Test",
"rollover_alias" : "filebeat01"
"refresh_interval" : "60s",
"number_of_shards" : "3",
"number_of_replicas" : "1"
"mappings" : { },
"aliases" : { }

Currently delete phase is working properly from the ILM but whenever I active the hot phase rollover it doesn't work. I have manually created one index with is_write_index set true. Then started sending data from filebeat to logstash.

I had to assign the rollover alias filebeat01 manually to each indices otherwise they show error that rollover alias filebeat01 does not point to index filebeat-2019-50`. But if I mention the alias in the template it shows another error that alias is duplicate.

Please help to solve this issue. Thanks in advance.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.