# Logstash Indices Rollover to Warm

**URL:** <https://discuss.elastic.co/t/logstash-indices-rollover-to-warm/295058>\
**Category:** Logstash\
**Tags:** ilm-index-lifecycle-management\
**Created:** [January 21, 2022, 1:22pm UTC](https://discuss.elastic.co/t/logstash-indices-rollover-to-warm/295058 "2022-01-21T13:22:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![teamomni](https://avatars.discourse-cdn.com/v4/letter/t/278dde/32.png) [@teamomni](https://discuss.elastic.co/u/teamomni)\
**Post date:** [January 21, 2022, 1:22pm UTC](https://discuss.elastic.co/t/logstash-indices-rollover-to-warm/295058/1 "2022-01-21T13:22:36Z")

</div>

We have been having issues getting our Logstash data to rollover from hot to warm after 30 days on our Elastic Cloud server. Before we change any settings, we would like to make sure we understand what we are doing.

Currently the output in the Logstash pipeline is set as ilm\_enabled =\> auto and we had created an Index Lifecycle Policy named company-logstash-policy in the Stack Management set to rollover from hot to warm at 50GBs or 30 days. We are getting several errors including:

```auto
illegal_argument_exception: index.lifecycle.rollover_alias [company-logstash-alias] does not point to index [company-logstash-2021.11.11]
illegal_argument_exception: rollover target [company-logstash-alias] does not point to a write index

```

From reading [Elasticsearch output plugin](https://www.elastic.co/guide/en/logstash/master/plugins-outputs-elasticsearch.html) as well as a discussion posts, should we leave the policy, modify the output to look similar to this snippet, and reindex all current Logstash indices?

```auto
output {
  elasticsearch {
    cloud_id => "<ID>"
    ssl => true
    user => "<USERNAME>"
    password => "<PASSWORD>"
    index => "company-logstash-%{+YYYY.MM.dd}"
    ilm_enabled => true
    ilm_rollover_alias => "company-logstash-alias"
    ilm_pattern => "000001"
    ilm_policy => "company-logstash-policy"
  }
}

```

As result we should have hot indices like:

company-logstash-2021-11-11

company-logstash-2021-11-12

company-logstash-2021-11-13

And then after 30 days they will rollover to warm indices like:

company-logstash-alias -000001

company-logstash-alias -000002

company-logstash-alias -000003

Are we understanding this correctly or will this lead to further issues in our stack? Is this issue caused by something completely different?

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 18, 2022, 1:23pm UTC](https://discuss.elastic.co/t/logstash-indices-rollover-to-warm/295058/2 "2022-02-18T13:23:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.