This sounds similar to what occurs when an ILM policy with Rollover is used, but the index template either doesn't exist or doesn't have index.lifecycle.name set.
Could you post the index template that's being used for your indices? Do you have any of template, manage_template, or template_overwrite set in your Logstash output config? Have you manually changed the index template that Logstash installs?
It has index template with below properties included in setting
"index.lifecycle.name": "my_policy",
"index.lifecycle.rollover_alias": "my_index_alias"
Have set below template and template_name in logstash output.
template_name => "test_template"
template => "/home/user1/test-template.json" along with
ilm_enabled => true
ilm_rollover_alias => "my_index_alias"
ilm_pattern => "000001"
ilm_policy => "my_policy"
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.