Logstash created Index || index.lifecycle.rollover_alias is empty or not defined

Hi Elastic Team,

  • I have Indices in my Elastic cluster created from logstash based on date regex.
  • And these indices can be deleted after 3 days.
  • but below error comes up for all indices.

***Index lifecycle error illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [jh_application-2021-04-20] is empty or not defined***

logstash + ILM config is as below.
Please help troubleshoot the case.


  •            elasticsearch {*
  •                            hosts => ["DATANODE1","DATANODE2","DATANODE3"]*
  •                            index => "myindex-%{+YYYY-MM-dd}"*
  •            }*


When writing to an ILM policy you should have the write alias defined in the index setting of your Logstash output. Don't use the traditional way of date based patterns like you have.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.