Problem with ILM

[BoKu (Boris Kunstleben)]

Hello,

i have a problem understanding ILM with index alias on an custom created index. I have an custom index oracle-logs, which is feeded by logstash (which gets the documents from filebeat), it then sends the documents to an index oracle-logs, this is working.
But, i got this error in "index managment":

Index lifecycle error

illegal_argument_exception: index.lifecycle.rollover_alias [oraclelogs] does not point to index [oracle-logs-2018.08-000001]

I asume, i have a problem with my alias, but i don't understand how to create the correct alias.

Kind regards
Boris

[widhalmt (Thomas Widhalm)]

Hi,

Could you show us the Logstash configuration of the elasticsearch output? Please remember, to remove or mask any password.

Cheers,
Thomas

[BoKu (Boris Kunstleben)]

Hi Thomas,

this is my logstash output:

output {
  if "oracle-input" in [tags] {
  stdout { codec => rubydebug }
  elasticsearch {
    hosts => ["https://elasticserver1:9200","https://elasticserver2:9200","https://elasticserver3:9200"]
    #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    index => "oracle-logs-%{+YYYY.MM}-000001"
    user => elastic
    password => "<PASSWORD>"
    ssl => true
    cacert => "/path/to/cert.cer"
  }
}
}

Best regards
Boris

[widhalmt (Thomas Widhalm)]

Please replace your index setting with ilm_ settings.

Elasticsearch output plugin | Logstash Reference [7.10] | Elastic

And the following options.

You should be good with replacing index => with the following

ilm_rollover_alias => "oracle-logs"

The ilm_pattern setting has a default that will do what you tried with your index setting.

[BoKu (Boris Kunstleben)]

Hi Thomas,
thanks for your advise.
I changed the index to ilm_rollover_alias, a few days ago, and at first i thought that worked, but i just saw that see error is still there:

illegal_argument_exception: index.lifecycle.rollover_alias [oraclelogs] does not point to index [oracle-logs-2020.11.26-000001]

Kind regards
Boris