Index lost the alias rollover

Hi,

when the index make de rollover and delete step, index-000001 is deleted, but then fluentd creates a new index-000001 (instead write in index-000002) and de alias is deleted so appears the error

illegal_argument_exception: index.lifecycle.rollover_alias [indexwso2senalias] does not point to index [index-000001]

Does fluentd perhaps point to index-000001 instead of the write alias?

Please also share your configuration and the ILM policy.

Which version of Elasticsearch are you on?

Hi, in the td-agent.conf index name is index_name Index-000001
rollover creates a new index-000002 which grow until 450b and delete de index-00001 which is created again and the loose the alias

elastic version 8.2.1

{
  "2-days-or-5-gb" : {
    "version" : 2,
    "modified_date" : "2022-11-14T11:52:33.322Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "3gb",
              "max_age" : "2d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "2h",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    },
    "in_use_by" : {
      "indices" : [
        "index-000001",
        "index-000002"
      ],
      "data_streams" : [ ],
      "composable_templates" : [
        "index_template"
      ]
    }
  }
}

Fluentd config should point to the write alias, not the index name. You need to change that in the td-agent.conf file.

thank you!

but i dont understand it very well, then the fluentd.conf the index name should be
the alias which use in the template?

for example, i make the lifepolicy, then the template,

PUT _index_template/indextemplate
{
  "index_patterns": ["index-*"], 
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1,
      "index.lifecycle.name": "index-policy"
      "index.lifecycle.rollover_alias": "indexalias"  
    }
  }

and then create the alias and make it writeable

POST /_aliases
{
  "actions": [
    {
      "add": {
        "index": "index-*",
        "alias": "indexalias",
        "is_write_index": true
      }
    }
  ]

so if understand well the congif should be

<match **>
 @type elasticsearch
 index_name indexalias
 host 
 port 
 user 
 password 
 logstash_format 
</match>

Could you help me with my last question please?
how could point to the write alias in the conf file?
Thank you in advance

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.