Hello,
I apologise for the haphazard responses; I'm dealing with personal and professional commitments. 
- ILM status does not show any errors. Output for
GET /_ilm/status is
{
"operation_mode": "RUNNING"
}
-
I am skipping the second bullet point and is answered subscequently
-
The index with the error was sensitive, and hence, I did not dwell on it. I am, however, happy and comfortable sharing it.
-
A. As you can see, the error embedding appears and disappears without my intervention. Today (02-03-2025, ~1300 IST, there is no error warning 
)
-
B. The index it shows the error for is the largest one here:
I understand that the index name relates to a sensitive topic; the purpose was to evaluate electronic warfare and was part of my research at the university.
-
My statement that only one index failed rollover was incorrect. The correct status is no index after ~2021 has rolled over. Additionally, some indexes, such as packetbeat/auditbeat, are merged as a single one instead of taking the configuration as part of the logstash pipeline.
-
Yes, in one of the printscreens, I was attempting to create a new policy to force rollover (purely out of desperation)
-
May I please request the process to view ILM error logs? I am running logstash on Raspberry Pis, and I have removed logging for logstash to save on SD Card I/Os. Elasticsearch + Kibana are running on VMs where I should have logging (default state). Let me know where to check, and I will provide the logs.
-
Output for GET _alias/cowrie-logstash
{
"cowrie-logstash-2021.06.03-000011": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.05.04-000010": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.11.30-000017": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.12.30-000018": {
"aliases": {
"cowrie-logstash": {
"is_write_index": true
}
}
},
"cowrie-logstash-2021.09.01-000014": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2020.12.05-000005": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.07.03-000012": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.10.31-000016": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2020.10.06-000003": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.01.04-000006": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2020.08.09-000001": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.02.03-000007": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.08.02-000013": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2020.09.06-000002": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.03.05-000008": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.10.01-000015": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2020.11.05-000004": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
},
"cowrie-logstash-2021.04.04-000009": {
"aliases": {
"cowrie-logstash": {
"is_write_index": false
}
}
}
}
- Output for
{
"conditions": {
"max_age": "30d",
"max_primary_shard_size": "50gb",
"min_docs": "1"
}
Response
"acknowledged": false,
"shards_acknowledged": false,
"old_index": "cowrie-logstash-2021.12.30-000018",
"new_index": "cowrie-logstash-2025.03.02-000019",
"rolled_over": false,
"dry_run": true,
"lazy": false,
"conditions": {
"[max_age: 30d]": true,
"[max_primary_shard_size: 50gb]": true,
"[min_docs: 1]": true
}
}
- Output for
settings:
"indices": {
"cowrie-logstash-2021.12.30-000018": {
"version": 1482,
"mapping_version": 20,
"settings_version": 16,
"aliases_version": 4,
"routing_num_shards": 1024,
"state": "open",
"settings": {
"index": {
"lifecycle": {
"name": "logstash-policy",
"rollover_alias": "cowrie-logstash",
"indexing_complete": "true"
},
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_content"
}
}
},
"refresh_interval": "5s",
"number_of_shards": "1",
"provided_name": "<cowrie-logstash-{now/d}-000018>",
"creation_date": "1640884225151",
"priority": "100",
"number_of_replicas": "1",
"uuid": "g5GyH1aFTpC9n8pEGA0dLg",
"version": {
"created": "7160299"
}
}
},
ILM
"ilm": {
"phase": "hot",
"phase_definition": """{"policy":"logstash-policy","phase_definition":{"min_age":"0ms","actions":{"rollover":{"max_age":"30d","max_primary_shard_size":"50gb"}}},"version":4,"modified_date_in_millis":1622398401153}""",
"action_time": "1740749317958",
"phase_time": "1740748726875",
"action": "complete",
"step": "complete",
"creation_date": "1643743227492",
"step_time": "1740749317958"
},
Alias:
"aliases": [
"cowrie-logstash"
],
Rollover Info:
"rollover_info": {
"cowrie-logstash": {
"met_conditions": {},
"time": 1643743227492
}
},
I hope this helps, and I am again sorry for leaving the same thread halfway a year ago and putting in conflicting information. It was not intentional, and I will be more prudent.
Thank you.
