Index lost the alias rollover

Elastic Stack Elasticsearch
1

Hi,

when the index make de rollover and delete step, index-000001 is deleted, but then fluentd creates a new index-000001 (instead write in index-000002) and de alias is deleted so appears the error

illegal_argument_exception: index.lifecycle.rollover_alias [indexwso2senalias] does not point to index [index-000001]

2

Does fluentd perhaps point to index-000001 instead of the write alias?

Please also share your configuration and the ILM policy.

Which version of Elasticsearch are you on?

3

Hi, in the td-agent.conf index name is index_name Index-000001
rollover creates a new index-000002 which grow until 450b and delete de index-00001 which is created again and the loose the alias

elastic version 8.2.1

{
  "2-days-or-5-gb" : {
    "version" : 2,
    "modified_date" : "2022-11-14T11:52:33.322Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "3gb",
              "max_age" : "2d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "2h",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    },
    "in_use_by" : {
      "indices" : [
        "index-000001",
        "index-000002"
      ],
      "data_streams" : [ ],
      "composable_templates" : [
        "index_template"
      ]
    }
  }
}
4

Fluentd config should point to the write alias, not the index name. You need to change that in the td-agent.conf file.

5

thank you!

but i dont understand it very well, then the fluentd.conf the index name should be
the alias which use in the template?

for example, i make the lifepolicy, then the template,

PUT _index_template/indextemplate
{
  "index_patterns": ["index-*"], 
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1,
      "index.lifecycle.name": "index-policy"
      "index.lifecycle.rollover_alias": "indexalias"  
    }
  }

and then create the alias and make it writeable

POST /_aliases
{
  "actions": [
    {
      "add": {
        "index": "index-*",
        "alias": "indexalias",
        "is_write_index": true
      }
    }
  ]

so if understand well the congif should be

<match **>
 @type elasticsearch
 index_name indexalias
 host 
 port 
 user 
 password 
 logstash_format 
</match>
6

Could you help me with my last question please?
how could point to the write alias in the conf file?
Thank you in advance