Metricbeat not creating Index correctly

Elastic Stack Beats
3

So when you did that you deleted the write alias metricbeat-7.13.4 as well besides the actual indexes with the data in it. You don't want to do that.

When you initially ran setup the metricbeat-7.13.4 write alias was created it looked something like this you can read about them here. They are part of ILM. running setup will re-create it.

  "metricbeat-7.13.4-2021.10.07-000001" : {
    "aliases" : {
      "metricbeat-7.13.4" : {
        "is_write_index" : true
      }

When working properly, metricbeat writes to metricbeat-7.13.4 which is alias to the real index metricbeat-7.13.4-2021.10.07-000001

When the index rolls over another write alias is created and so on.

  "metricbeat-7.13.4-2021.10.08-000002" : {
    "aliases" : {
      "metricbeat-7.13.4" : {
        "is_write_index" : true
      }

(and the old one is no longer the write alias. "is_write_index" : false

When you deleted the alias and restarted metricbeat now the docs get written to metricbeat-7.13.4 because it is no longer aliased and it will no longer roll over etc.

Unfortunately you will need to delete that index and then run set up again.

You need to delete that new real index because its named the same as the write index... A case of name collision.

Need to clean it up, And then be careful not to delete it in the future.
:slight_smile:

1 Like