Logstash created Index || index.lifecycle.rollover_alias is empty or not defined

[Boris_Joseph]

Hi Elastic Team,

• I have Indices in my Elastic cluster created from logstash based on date regex.
• And these indices can be deleted after 3 days.
• but below error comes up for all indices.

***Index lifecycle error illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [jh_application-2021-04-20] is empty or not defined***

logstash + ILM config is as below.
Please help troubleshoot the case.

`output{

•            elasticsearch {*
  

•                            hosts => ["DATANODE1","DATANODE2","DATANODE3"]*
  

•                            index => "myindex-%{+YYYY-MM-dd}"*
  

•            }*
  

}`

[warkolm (Mark Walkom)]

When writing to an ILM policy you should have the write alias defined in the index setting of your Logstash output. Don't use the traditional way of date based patterns like you have.