# Latest rolled over data not searchable in Discover menu

**URL:** <https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937>\
**Category:** Kibana\
**Tags:** ilm-index-lifecycle-management\
**Created:** [August 30, 2023, 3:52am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937 "2023-08-30T03:52:51Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Geeboy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geeboy/32/121876_2.png) [@Geeboy](https://discuss.elastic.co/u/Geeboy)\
**Post date:** [August 30, 2023, 3:52am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/1 "2023-08-30T03:52:51Z")

</div>

Im new to ELK (Im using td-agent as log forwarder) I have created ILM rollover in my dev environment, my index was successfully rolling over, but I can't search the new index in the latest rollover in the discover. i have also added my index in Data Views. sharing my config below.

```auto
GET cinqv2*/_alias/cinqv2-alias?pretty
{
  "cinqv2" : {
    "aliases" : {
      "cinqv2-alias" : { }
    }
  },
  "cinqv2-000003" : {
    "aliases" : {
      "cinqv2-alias" : {
        "is_write_index" : true
      }
    }
  },
  "cinqv2-000002" : {
    "aliases" : {
      "cinqv2-alias" : {
        "is_write_index" : false
      }
    }
  },
  "cinqv2-000001" : {
    "aliases" : {
      "cinqv2-alias" : {
        "is_write_index" : false
      }
    }
  }
}

```

```auto
GET _index_template/default-template
{
  "index_templates" : [
    {
      "name" : "default-template",
      "index_template" : {
        "index_patterns" : [
          "cinqv2-*"
        ],
        "template" : {
          "settings" : {
            "index" : {
              "lifecycle" : {
                "name" : "default_policy",
                "rollover_alias" : "cinqv2-alias"
              },
              "number_of_shards" : "1",
              "number_of_replicas" : "0"
            }
          },
          "mappings" : {
            "_source" : {
              "enabled" : true
            }
          }
        },
        "composed_of" : []
      }
    }
  ]
}

```

```auto
GET _ilm/policy/default_policy
{
  "default_policy" : {
    "version" : 2,
    "modified_date" : "2023-08-29T23:32:59.573Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "200kb",
              "max_age" : "30m", ---->> for quick rollover scenario
              "max_docs" : 100
            }
          }
        },
        "delete" : {
          "min_age" : "1d",
          "actions" : {
            "delete" : {
              "delete_searchable_snapshot" : true
            }
          }
        }
      }
    },
    "in_use_by" : {
      "indices" : [
        "cinqv2-000001",
        "cinqv2-000003",
        "cinqv2-000002"
      ],
      "data_streams" : [],
      "composable_templates" : [
        "default-template"
      ]
    }
  }
}

```

on this image. trying to search the \_index (cinqv2-000001) but can't find it via discover menu.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/e/feb5a5b8a839b2503fdac60e5d959da3f9baa8f0.png)

---

<div class="post-metadata">

**Author:** ![Geeboy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geeboy/32/121876_2.png) [@Geeboy](https://discuss.elastic.co/u/Geeboy)\
**Post date:** [August 30, 2023, 4:51am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/2 "2023-08-30T04:51:08Z")

</div>

here is my index rollover

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7c80c5f19ee3107da43c69a590575b08d839992a.png)

---

<div class="post-metadata">

**Author:** ![Geeboy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geeboy/32/121876_2.png) [@Geeboy](https://discuss.elastic.co/u/Geeboy)\
**Post date:** [August 30, 2023, 5:48am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/3 "2023-08-30T05:48:40Z")

</div>

Any help in understanding where I could have gone wrong in my setup or formatting would be greatly appreciated. Thanks in advance

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 30, 2023, 6:06am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/4 "2023-08-30T06:06:29Z")

</div>

How did you create the index pattern/ data view?

Is the index pattern

`cinqv2-*`

Do any of the indices show?

---

<div class="post-metadata">

**Author:** ![Geeboy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geeboy/32/121876_2.png) [@Geeboy](https://discuss.elastic.co/u/Geeboy)\
**Post date:** [August 30, 2023, 6:22am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/5 "2023-08-30T06:22:24Z")

</div>

thank you very much for your reply. I used this command (executed via kibana console). the only index I can see in the discover (\_index) is cinqv2, nothing more.

```auto
PUT cinqv2/_alias/cinqv2-alias

```

```auto
PUT cinqv2-000001
{
   "aliases": {
        "cinqv2-alias":{
            "is_write_index": true
        }
    }
}

```

I created the data view using the kibana UI (Create data view botton)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af66e0799510eb64179e692a8203d65e07ceb7b6.png)

here is the list of rollover indexes

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f5596a92d0bf69488341c41f5431e87685f4ad2.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 30, 2023, 1:54pm UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/6 "2023-08-30T13:54:34Z")

</div>

Your index pattern is only matching the very first index `cinqv2` it is not matching i.e. then you are not searching any of the other indices,

That is what I'm trying to say

The index pattern needs to be  
`cinqv2*` as the matching pattern to match all the indices or you will need to put `cinqv2,cinqv2-*` to account for both patterns

it is not best practice to have  
`cinqv2`  
`cinqv2-000001`

---

<div class="post-metadata">

**Author:** ![Geeboy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geeboy/32/121876_2.png) [@Geeboy](https://discuss.elastic.co/u/Geeboy)\
**Post date:** [August 31, 2023, 12:32am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/7 "2023-08-31T00:32:04Z")

</div>

good day Sir, is this the only parameter that I need to change? from "cinqv2-_" change to "cinqv2_"

```auto
GET _index_template/default-template
{
  "index_templates" : [
    {
      "name" : "default-template",
      "index_template" : {
        "index_patterns" : [
          "cinqv2*"
        ],

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 31, 2023, 12:38am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/8 "2023-08-31T00:38:51Z")

</div>

That is the template you don't need to change that, the template is on the index creation process.

You need to change the index pattern which is used for the search / Discover/ visualization

Stack Management -\> Index Pattern...that is what you need to fix.

This one

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af66e0799510eb64179e692a8203d65e07ceb7b6.png)

Delete it a recreate with

`cinqv2*`

The check Discover

---

<div class="post-metadata">

**Author:** ![Geeboy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geeboy/32/121876_2.png) [@Geeboy](https://discuss.elastic.co/u/Geeboy)\
**Post date:** [August 31, 2023, 12:55am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/9 "2023-08-31T00:55:00Z")

</div>

thanks for this Sir. i already create new index (cinqv2\*) in "data views"  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/215f2f80cf873d0a5e23c99f5b1f7c0d09550e85.png)

do i need to delete the old index (cinqv2) in data views and delete all in index management?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 31, 2023, 12:59am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/10 "2023-08-31T00:59:43Z")

</div>

I would get rid of the old data view. You don't need to get rid of the index unless you want to

Technically in the data view you could define the index pattern

`cinqv2,cinqv2-*`

To cover both that original index and the ones with the numbers

One gotcha. Don't put a space after the comms

---

<div class="post-metadata">

**Author:** ![Geeboy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geeboy/32/121876_2.png) [@Geeboy](https://discuss.elastic.co/u/Geeboy)\
**Post date:** [August 31, 2023, 1:16am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/11 "2023-08-31T01:16:59Z")

</div>

GREAT! I can now view the content of the rollover index in the discover. your a great help @stephenb thanks a lot 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2023, 1:17am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937/12 "2023-09-28T01:17:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.