# Index.lifecycle.rollover\_alias \[filebeat-7.17.7\] does not point to index \[filebeat-7.17.7-2022.12.21\]

**URL:** <https://discuss.elastic.co/t/index-lifecycle-rollover-alias-filebeat-7-17-7-does-not-point-to-index-filebeat-7-17-7-2022-12-21/321917>\
**Category:** Logstash\
**Tags:** ilm-index-lifecycle-management\
**Created:** [December 23, 2022, 1:46pm UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-filebeat-7-17-7-does-not-point-to-index-filebeat-7-17-7-2022-12-21/321917 "2022-12-23T13:46:33Z")\
**Posts on this page:** 1\
**Showing post:** 14

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 25, 2022, 4:01pm UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-filebeat-7-17-7-does-not-point-to-index-filebeat-7-17-7-2022-12-21/321917/14 "2022-12-25T16:01:07Z")

</div>

First in general It's always hard to help when users use third party articles to set up, but I think I found your issue.

Your issue is your output section I would follow the [link](https://discuss.elastic.co/t/filebeat-modules-via-logstash/263612/2) I gave you above as I know it works and you can see it's been used by many other people

This is the correct version. Notice that it does not have the date portion on the index.

Correct Write alias

`filebeat-7.17.7`

What your log stash is trying to write to you  
`filebeat-7.17.7-2022.12.21`

That is because the write alias does not have to date portion on the index name which is also correct...

And although it's a little hard to understand, that's exactly what your error message is saying you're writing to something that's not the rollover alias.

If you run filebeat setup it will create the alias without the date part and then it should work.

You may need to clean up and run `filebeat setup -e` again when you have filebeat configured the point to elasticsearch.

BTW our docs also have this wrong ☹ if you are using ILM which most folks do..

Below is correct

Note no date portion on the `index`

```auto
output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      user => "elastic"
      password => "secret"
    }
  }
}

```

---

_[View the full topic](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-filebeat-7-17-7-does-not-point-to-index-filebeat-7-17-7-2022-12-21/321917)._