# Index LifeCycle Management

**URL:** <https://discuss.elastic.co/t/index-lifecycle-management/356759>\
**Category:** Elasticsearch\
**Created:** [April 4, 2024, 10:18am UTC](https://discuss.elastic.co/t/index-lifecycle-management/356759 "2024-04-04T10:18:15Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![spazzrabbit](https://avatars.discourse-cdn.com/v4/letter/s/0ea827/32.png) [@spazzrabbit](https://discuss.elastic.co/u/spazzrabbit)\
**Post date:** [April 4, 2024, 10:18am UTC](https://discuss.elastic.co/t/index-lifecycle-management/356759/1 "2024-04-04T10:18:15Z")

</div>

Hello everyone,

I'm having issues with lifecycle policy.  
Currently I'm receiving log from one windows server, logstash outputs it to elastic succesfully. When lifecycle begins it creates new index but keeps writing to old one. I want it to write to new index.  
Here is my configurations;

![image](https://us1.discourse-cdn.com/elastic/original/3X/1/d/1d06c1a3bb1e7268bae53cd1ed8ac52d045a5231.png)

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/94eb6f90a0a751d6e540a817855ee2c39c768d97.png)

![image](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e646b31f1c7b62d94472c686c7c710a611bdb51f.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fe34cf4fae500c7f9025949e2da38e6e646dc505.png)

Waiting for kind help,

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 4, 2024, 10:30am UTC](https://discuss.elastic.co/t/index-lifecycle-management/356759/2 "2024-04-04T10:30:18Z")

</div>

When you use rollover you must always write to the rollover alias (`winlogbeat`) and not directly to the first index (`winlogbeat-000001`) as you are now.

---

<div class="post-metadata">

**Author:** ![spazzrabbit](https://avatars.discourse-cdn.com/v4/letter/s/0ea827/32.png) [@spazzrabbit](https://discuss.elastic.co/u/spazzrabbit)\
**Post date:** [April 4, 2024, 10:40am UTC](https://discuss.elastic.co/t/index-lifecycle-management/356759/3 "2024-04-04T10:40:29Z")

</div>

I suppose my alias name is right but, what could I write for the index name ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 4, 2024, 10:44am UTC](https://discuss.elastic.co/t/index-lifecycle-management/356759/4 "2024-04-04T10:44:13Z")

</div>

When you use rollover you write to the alias. If you do not, rollover can not switch indices behind the scenes, which is the whole point of rollover.

---

<div class="post-metadata">

**Author:** ![spazzrabbit](https://avatars.discourse-cdn.com/v4/letter/s/0ea827/32.png) [@spazzrabbit](https://discuss.elastic.co/u/spazzrabbit)\
**Post date:** [April 4, 2024, 10:53am UTC](https://discuss.elastic.co/t/index-lifecycle-management/356759/5 "2024-04-04T10:53:53Z")

</div>

So should I rename my index (in output file) same with my alias ? (winlogbeat in this case)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 4, 2024, 11:01am UTC](https://discuss.elastic.co/t/index-lifecycle-management/356759/6 "2024-04-04T11:01:43Z")

</div>

Yes.

---

<div class="post-metadata">

**Author:** ![spazzrabbit](https://avatars.discourse-cdn.com/v4/letter/s/0ea827/32.png) [@spazzrabbit](https://discuss.elastic.co/u/spazzrabbit)\
**Post date:** [April 5, 2024, 6:45am UTC](https://discuss.elastic.co/t/index-lifecycle-management/356759/7 "2024-04-05T06:45:56Z")

</div>

Thank you Christian\_Dahlqvist!

If anyone else having the same issue,

My logstash output index name is "winlogbeat"  
I defined rollover.index.name in index template as "winlogbeat"

Thing that fixed my problem after I changed my aliases is deleting alias on the index template. I've created first index manually with following command on DevConsole;

```auto
PUT winlogbeat-000001
{
  "aliases": {
    "winlogbeat": {
      "is_write_index": true
    }
  }
}

```