No Write Index in Elasticsearch

[wcpoon (Woody)]

Hi,

I accidently deleted the active logstash-xxxxx indices.
Now my logs cannot index.

I check the logstash logs, below is the warning.

[2022-04-01T18:11:02,900][WARN ][logstash.outputs.elasticsearch][main][bd7d93f8f848f88730fdeca9c2925995bc0a0df5cb73806c2b3bf452710a2051] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash", :routing=>nil}, {"@timestamp"=>2022-04-01T10:11:02.873945Z, "process.name"=>"charon", "timestamp"=>"2022-04-01T18:11:07.019+0800", "syslog_message"=>"- - - 15[CFG] no IDr configured, fall back on IP address", "syslog_hostname"=>"nsx-controller", "message"=>"<30>1 2022-04-01T18:11:07.019+0800 nsx-controller charon - - - 15[CFG] no IDr configured, fall back on IP address", "event"=>{"original"=>"<30>1 2022-04-01T18:11:07.019+0800 nsx-controller charon - - - 15[CFG] no IDr configured, fall back on IP address"}, "@version"=>"1", "type"=>"syslog", "received_from"=>"{"ip":"10.253.205.103"}", "tags"=>["_grokparsefailure"], "host"=>{"ip"=>"10.253.205.103"}, "received_at"=>"2022-04-01T10:11:02.873945Z"}], :response=>{"index"=>{"_index"=>"logstash", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"no write index is defined for alias [logstash]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"}}}}

what should I do to rescue it?

[wcpoon (Woody)]

I managed to resolved it.

PUT logstash-2022.04.01-000004-2
{
  "aliases": {
    "logstash": {
      "is_write_index": true
    }
  }
}  

Thanks.