Problem with ILM


i have a problem understanding ILM with index alias on an custom created index. I have an custom index oracle-logs, which is feeded by logstash (which gets the documents from filebeat), it then sends the documents to an index oracle-logs, this is working.
But, i got this error in "index managment":

Index lifecycle error

illegal_argument_exception: index.lifecycle.rollover_alias [oraclelogs] does not point to index [oracle-logs-2018.08-000001]

I asume, i have a problem with my alias, but i don't understand how to create the correct alias.

Kind regards


Could you show us the Logstash configuration of the elasticsearch output? Please remember, to remove or mask any password.


Hi Thomas,

this is my logstash output:

output {
  if "oracle-input" in [tags] {
  stdout { codec => rubydebug }
  elasticsearch {
    hosts => ["https://elasticserver1:9200","https://elasticserver2:9200","https://elasticserver3:9200"]
    #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    index => "oracle-logs-%{+YYYY.MM}-000001"
    user => elastic
    password => "<PASSWORD>"
    ssl => true
    cacert => "/path/to/cert.cer"

Best regards

Please replace your index setting with ilm_ settings.

And the following options.

You should be good with replacing index => with the following

ilm_rollover_alias => "oracle-logs"

The ilm_pattern setting has a default that will do what you tried with your index setting.

1 Like

Hi Thomas,
thanks for your advise.
I changed the index to ilm_rollover_alias, a few days ago, and at first i thought that worked, but i just saw that see error is still there:

illegal_argument_exception: index.lifecycle.rollover_alias [oraclelogs] does not point to index [oracle-logs-2020.11.26-000001]

Kind regards

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.