# No Write Index in Elasticsearch

**URL:** <https://discuss.elastic.co/t/no-write-index-in-elasticsearch/301306>\
**Category:** Elasticsearch\
**Created:** [April 1, 2022, 10:17am UTC](https://discuss.elastic.co/t/no-write-index-in-elasticsearch/301306 "2022-04-01T10:17:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wcpoon](https://avatars.discourse-cdn.com/v4/letter/w/da6949/32.png) [@wcpoon](https://discuss.elastic.co/u/wcpoon)\
**Post date:** [April 1, 2022, 10:17am UTC](https://discuss.elastic.co/t/no-write-index-in-elasticsearch/301306/1 "2022-04-01T10:17:26Z")

</div>

Hi,

I accidently deleted the active logstash-xxxxx indices.  
Now my logs cannot index.

I check the logstash logs, below is the warning.

> [2022-04-01T18:11:02,900][WARN][logstash.outputs.elasticsearch][main][bd7d93f8f848f88730fdeca9c2925995bc0a0df5cb73806c2b3bf452710a2051] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash", :routing=\>nil}, {"@timestamp"=\>2022-04-01T10:11:02.873945Z, "process.name"=\>"charon", "timestamp"=\>"2022-04-01T18:11:07.019+0800", "syslog\_message"=\>"- - - 15[CFG] no IDr configured, fall back on IP address", "syslog\_hostname"=\>"nsx-controller", "message"=\>"\<30\>1 2022-04-01T18:11:07.019+0800 nsx-controller charon - - - 15[CFG] no IDr configured, fall back on IP address", "event"=\>{"original"=\>"\<30\>1 2022-04-01T18:11:07.019+0800 nsx-controller charon - - - 15[CFG] no IDr configured, fall back on IP address"}, "@version"=\>"1", "type"=\>"syslog", "received\_from"=\>"{"ip":"10.253.205.103"}", "tags"=\>["\_grokparsefailure"], "host"=\>{"ip"=\>"10.253.205.103"}, "received\_at"=\>"2022-04-01T10:11:02.873945Z"}], :response=\>{"index"=\>{"\_index"=\>"logstash", "\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"no write index is defined for alias [logstash]. The write index may be explicitly disabled using is\_write\_index=false or the alias points to multiple indices without one being designated as a write index"}}}}

what should I do to rescue it?

---

<div class="post-metadata">

**Author:** ![wcpoon](https://avatars.discourse-cdn.com/v4/letter/w/da6949/32.png) [@wcpoon](https://discuss.elastic.co/u/wcpoon)\
**Post date:** [April 1, 2022, 10:23am UTC](https://discuss.elastic.co/t/no-write-index-in-elasticsearch/301306/2 "2022-04-01T10:23:55Z")

</div>

I managed to resolved it.

```auto
PUT logstash-2022.04.01-000004-2
{
  "aliases": {
    "logstash": {
      "is_write_index": true
    }
  }
}  

```

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2022, 10:24am UTC](https://discuss.elastic.co/t/no-write-index-in-elasticsearch/301306/3 "2022-04-29T10:24:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.