Index.lifecycle.rollover_alias [filebeat-7.17.7] does not point to index [filebeat-7.17.7-2022.12.21]

Elastic Stack Logstash
14

First in general It's always hard to help when users use third party articles to set up, but I think I found your issue.

Your issue is your output section I would follow the link I gave you above as I know it works and you can see it's been used by many other people

This is the correct version. Notice that it does not have the date portion on the index.

Correct Write alias

filebeat-7.17.7

What your log stash is trying to write to you
filebeat-7.17.7-2022.12.21

That is because the write alias does not have to date portion on the index name which is also correct...

And although it's a little hard to understand, that's exactly what your error message is saying you're writing to something that's not the rollover alias.

If you run filebeat setup it will create the alias without the date part and then it should work.

You may need to clean up and run filebeat setup -e again when you have filebeat configured the point to elasticsearch.

BTW our docs also have this wrong :frowning: if you are using ILM which most folks do..

Below is correct

Note no date portion on the index

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      user => "elastic"
      password => "secret"
    }
  }
}