Problem with ILM

Hello,

i have a problem understanding ILM with index alias on an custom created index. I have an custom index oracle-logs, which is feeded by logstash (which gets the documents from filebeat), it then sends the documents to an index oracle-logs, this is working.
But, i got this error in "index managment":

Index lifecycle error

illegal_argument_exception: index.lifecycle.rollover_alias [oraclelogs] does not point to index [oracle-logs-2018.08-000001]

I asume, i have a problem with my alias, but i don't understand how to create the correct alias.

Kind regards
Boris

Hi,

Could you show us the Logstash configuration of the elasticsearch output? Please remember, to remove or mask any password.

Cheers,
Thomas

Hi Thomas,

this is my logstash output:

output {
  if "oracle-input" in [tags] {
  stdout { codec => rubydebug }
  elasticsearch {
    hosts => ["https://elasticserver1:9200","https://elasticserver2:9200","https://elasticserver3:9200"]
    #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    index => "oracle-logs-%{+YYYY.MM}-000001"
    user => elastic
    password => "<PASSWORD>"
    ssl => true
    cacert => "/path/to/cert.cer"
  }
}
}

Best regards
Boris

Please replace your index setting with ilm_ settings.

And the following options.

You should be good with replacing index => with the following

ilm_rollover_alias => "oracle-logs"

The ilm_pattern setting has a default that will do what you tried with your index setting.

1 Like

Hi Thomas,
thanks for your advise.
I changed the index to ilm_rollover_alias, a few days ago, and at first i thought that worked, but i just saw that see error is still there:

illegal_argument_exception: index.lifecycle.rollover_alias [oraclelogs] does not point to index [oracle-logs-2020.11.26-000001]

Kind regards
Boris

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.