Indexes rolling over due to ILM are not adding an alias

[perfecto25]

Hello, is it possible to configure Filebeat, Metricbeat, etc to automaticlaly create an alias whenever the index rolls over a to a new one due to ILM lifecycle policy?,

ie, my index for Fbeat rolled over due to ILM policy, the new index is filebeat-7.17.0-2022.04.25 (it doesnt have "filebeat" as an alias)

Im getting this in filebeat log on the host

filebeat: 2022-05-06T13:32:10.934-0400#011ERROR#011[publisher_pipeline_output]#011pipeline/output.go:154#011Failed to connect to backoff(elasticsearch(https://elk.corp.com:9200)): Connection marked as failed because the onConnect callback failed: resource 'filebeat-7.17.0' exists, but it is not an alias

right now I have to manually update all indexes with an alias,

    POST /_aliases
    {
    "actions" : [
        { "add" : { "index" : "filebeat-7.17.0-2022.03.01", "alias" : "filebeat" } }
    ]
    }

is there a setting Im missing so this auto-adds a "filebeat" alias to each new rolled over indx

also, is there a way to alert if a certain index is not getting fed into Elasticsearch? I just realized my prod servers werent sending any filebeat data due to this alias error.

[stephenb (Stephen Brown)]

Problem most likely is at some point you accidentally deleted the alias and then filebeat started writing an actual index with the alias name. This is a pretty common error.

Then it will never roll over.

If you just run setup it will recreate the alias unless there's already a real index with that name, which is probably the situation you're in... So running set up will not work in this case.

You Will need to clean up the index that has the alias name and then run set up again and it should all be ready to go.