New to ELK and need some help with existing environment

Elastic Stack Elasticsearch
1

My company uses ELK on kubernetes to monitor CICD infrastructure. We have an index that gathers a massive amount of data every day. We recently stopped showing data in the discover section. All data before two weeks ago still shows up but no new data shows up. We are still showing data being gathered since the document number is still growing in the index. I am not sure if this is a ILM issue or not but we are seeing the following error

illegal_argument_exception: index name [jobhookwithtrace] does not match pattern '^.*-\d+$'

As far as I can tell from my research I cannot do much about changing the name of the index, the problem is the index still receives data and I am not sure how to proceed.

2

Welcome to our community! :smiley:

You're going to need to provide some of the details that have been requested in your reddit thread - https://www.reddit.com/r/elasticsearch/comments/ur5mke/new_to_elasticsearch_and_having_some_issues/

3

So my indexes are all green, I am not certain if ILM has any affect on my kibana searches coming up. Currently we are running on ELK version v 7.10.1 on AKS engine (moving to AKS soon).

the status of the indice we are having an issue searching is

health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open jobhookwithtrace eTMFw2nsQXu59J086CPZ1A 1 1 2731462 64 236gb 117.8gb

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.