# Index Lifecycle Rollover Alias is Empty in Winlogbeat Indices

**URL:** https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415
**Category:** Beats
**Tags:** ilm-index-lifecycle-management, winlogbeat
**Created:** [April 14, 2022, 9:58am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415 "2022-04-14T09:58:14Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![wcpoon](https://avatars.discourse-cdn.com/v4/letter/w/da6949/32.png) [@wcpoon](https://discuss.elastic.co/u/wcpoon)
#### Post date: [April 14, 2022, 9:58am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415/1 "2022-04-14T09:58:14Z")

</div>

Hi,

I'm having below errors "index.lifecycle.rollover\_alias" in winlogbeats indices.

```auto
Index lifecycle error
illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [winlogbeat-8.1.2-2022.04.14] is empty or not defined

```

When I loaded the winlogbeat template, it doesn't include index.lifecycle.rollover\_alias.  
Any one can advice me how to resolve this?  
Appreciate it.

---

<div class="post-metadata">

### Author: ![wcpoon](https://avatars.discourse-cdn.com/v4/letter/w/da6949/32.png) [@wcpoon](https://discuss.elastic.co/u/wcpoon)
#### Post date: [April 15, 2022, 3:04am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415/2 "2022-04-15T03:04:12Z")

</div>

I manually assigned below configuration in index template of winlogbeat

`"rollover_alias": "winlogbeat-8.1.2"`

But I still getting error to rollover my indices.

 ![Screenshot 2022-04-15 110201](https://us1.discourse-cdn.com/elastic/original/3X/8/4/8463885292927eb59f12422104a4013d4f65d608.png)

U can see that my indices Aliases is " **none**".

Appreciate someone can advise me what to do..

---

<div class="post-metadata">

### Author: ![wcpoon](https://avatars.discourse-cdn.com/v4/letter/w/da6949/32.png) [@wcpoon](https://discuss.elastic.co/u/wcpoon)
#### Post date: [April 15, 2022, 3:09am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415/3 "2022-04-15T03:09:27Z")

</div>

My beat in logstash output to Elasticsearch config as below,

```auto
input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["https://xxxxxxxxxx:9200"]
    cacert => '/etc/logstash/certs/http_ca.crt'
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    ssl => "true"
    api_key => "xxxxxxxxxx"
  }
}

```

---

<div class="post-metadata">

### Author: ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)
#### Post date: [May 5, 2022, 6:05pm UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415/4 "2022-05-05T18:05:14Z")

</div>

Hi,

Please to check this out ,

> **[Rollover | Elasticsearch Guide \[8.2\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-rollover.html)**

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 5, 2022, 6:12pm UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415/5 "2022-05-05T18:12:34Z")

</div>

If your rollover alias is `winlogbeat-8.1.2`

> [@wcpoon](#):
>
> ```auto
> output {
> elasticsearch {
> hosts => ["https://xxxxxxxxxx:9200"]
> cacert => '/etc/logstash/certs/http_ca.crt'
> index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
> ssl => "true"
> api_key => "xxxxxxxxxx"
> }
> }
> 
> ```

then it should be without the date so logstash is writing to the write alias...

` index => "%{[@metadata][beat]}-%{[@metadata][version]}"`

---

<div class="post-metadata">

### Author: ![wcpoon](https://avatars.discourse-cdn.com/v4/letter/w/da6949/32.png) [@wcpoon](https://discuss.elastic.co/u/wcpoon)
#### Post date: [May 6, 2022, 2:11am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415/6 "2022-05-06T02:11:54Z")

</div>

Yup, it works.  
Thanks a lot ~

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 3, 2022, 4:12am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty-in-winlogbeat-indices/302415/7 "2022-06-03T04:12:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.