Need assistance with creating daily winlogbeat indices that follow an ILM policy

Elastic Stack Beats
1

I created a winlogbeat index with a PUT request as so :

PUT /%3Cwinlogbeat-%7Bnow%2Fd%7D-000001%3E
{
"aliases": {
"winlogbeat": {
"is_write_index": true
}
}
}

It then asked me to select a rollover alias from a dropdown. I selected the only option which was "winlogbeat". However when I look at the index template, it does not show a rollover_alias in the settings nor an alias.

We are also getting this error for the index we created :

illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [winlogbeat-2022.03.25-000002] is empty or not defined

So how do I fix this and get daily indices that follow a deletion pattern?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.