Index Lifecycle Rollover Alias is Empty in Winlogbeat Indices


I'm having below errors "index.lifecycle.rollover_alias" in winlogbeats indices.

Index lifecycle error
illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [winlogbeat-8.1.2-2022.04.14] is empty or not defined

When I loaded the winlogbeat template, it doesn't include index.lifecycle.rollover_alias.
Any one can advice me how to resolve this?
Appreciate it.

I manually assigned below configuration in index template of winlogbeat

"rollover_alias": "winlogbeat-8.1.2"

But I still getting error to rollover my indices.

U can see that my indices Aliases is "none".

Appreciate someone can advise me what to do..

My beat in logstash output to Elasticsearch config as below,

input {
  beats {
    port => 5044

output {
  elasticsearch {
    hosts => ["https://xxxxxxxxxx:9200"]
    cacert => '/etc/logstash/certs/http_ca.crt'
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    ssl => "true"
    api_key => "xxxxxxxxxx"


Please to check this out ,

If your rollover alias is winlogbeat-8.1.2

then it should be without the date so logstash is writing to the write alias...

index => "%{[@metadata][beat]}-%{[@metadata][version]}"

1 Like

Yup, it works.
Thanks a lot ~

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.