Index Lifecycle Rollover Alias is Empty in Winlogbeat Indices

[wcpoon (Woody)]

Hi,

I'm having below errors "index.lifecycle.rollover_alias" in winlogbeats indices.

Index lifecycle error
illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [winlogbeat-8.1.2-2022.04.14] is empty or not defined

When I loaded the winlogbeat template, it doesn't include index.lifecycle.rollover_alias.
Any one can advice me how to resolve this?
Appreciate it.

[wcpoon (Woody)]

I manually assigned below configuration in index template of winlogbeat

"rollover_alias": "winlogbeat-8.1.2"

But I still getting error to rollover my indices.

U can see that my indices Aliases is "none".

Appreciate someone can advise me what to do..

[wcpoon (Woody)]

My beat in logstash output to Elasticsearch config as below,

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["https://xxxxxxxxxx:9200"]
    cacert => '/etc/logstash/certs/http_ca.crt'
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    ssl => "true"
    api_key => "xxxxxxxxxx"
  }
}

[ibra_013 (Ibra13)]

Hi,

Please to check this out ,

Rollover | Elasticsearch Guide [8.2] | Elastic

[stephenb (Stephen Brown)]

If your rollover alias is winlogbeat-8.1.2

@wcpoon

output {
  elasticsearch {
    hosts => ["https://xxxxxxxxxx:9200"]
    cacert => '/etc/logstash/certs/http_ca.crt'
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    ssl => "true"
    api_key => "xxxxxxxxxx"
  }
}

then it should be without the date so logstash is writing to the write alias...

index => "%{[@metadata][beat]}-%{[@metadata][version]}"

[wcpoon (Woody)]

Yup, it works.
Thanks a lot ~