# Resource metricbeat-7.17.1 exists, but it is not an alias

**URL:** <https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030>\
**Category:** Beats\
**Tags:** ilm-index-lifecycle-management, metricbeat\
**Created:** [May 31, 2022, 12:09pm UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030 "2022-05-31T12:09:52Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Evgeny\_Barykin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evgeny_barykin/32/104350_2.png) [@Evgeny\_Barykin](https://discuss.elastic.co/u/Evgeny_Barykin)\
**Post date:** [May 31, 2022, 12:09pm UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030/1 "2022-05-31T12:09:52Z")

</div>

Hello!  
I have an issue with connecting second cluster to Elasticsearch. I changed dynamic mappings and added best\_compression to the settings, but now I get an error every time I try to connect new beats to it.  
If I leave the field from the automatically created index pattern:

```auto
"lifecycle": {
      "name": "metricbeat",
      "rollover_alias": "metricbeat-7.17.1"
    },

```

It will give me an error:

 ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/2/6/2653ebae6bbe57b870a85fdeef251190973fa60c.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 31, 2022, 2:01pm UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030/2 "2022-05-31T14:01:16Z")

</div>

Take a look at this post see if it helps

> [@Metricbeat not creating Index correctly](https://discuss.elastic.co/t/metricbeat-not-creating-index-correctly/285863/3):
>
> So when you did that you deleted the write alias metricbeat-7.13.4 as well besides the actual indexes with the data in it. You don't want to do that. When you initially ran setup the metricbeat-7.13.4 write alias was created it looked something like this you can read about them [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.15/aliases.html#write-index). They are part of ILM. running setup will re-create it. "metricbeat-7.13.4-2021.10.07-000001" : { "aliases" : { "metricbeat-7.13.4" : { "is\_write\_index" : true } When working properly, …

---

<div class="post-metadata">

**Author:** ![Evgeny\_Barykin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evgeny_barykin/32/104350_2.png) [@Evgeny\_Barykin](https://discuss.elastic.co/u/Evgeny_Barykin)\
**Post date:** [May 31, 2022, 2:46pm UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030/3 "2022-05-31T14:46:18Z")

</div>

Thank you, that is helpful. So I need to add alias to the index template to solve the problem, right?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 31, 2022, 2:56pm UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030/4 "2022-05-31T14:56:00Z")

</div>

Yes and you will need to clean up the current index as it is not an alias it is a real index.

If you are using metricbeat all this is done for you if you just run setup per the quick start.

Macro Steps

Stop all metricbeats  
Clean Up the bad index  
Run `metricbeat setup -e`  
Start All metricbeats

---

<div class="post-metadata">

**Author:** ![Evgeny\_Barykin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evgeny_barykin/32/104350_2.png) [@Evgeny\_Barykin](https://discuss.elastic.co/u/Evgeny_Barykin)\
**Post date:** [June 1, 2022, 11:05am UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030/5 "2022-06-01T11:05:36Z")

</div>

Can you give me an example of how do I add alias to the index template, please?  
Not sure how should I run setup, I am using helm charts to deploy metricbeat.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 2, 2022, 5:27am UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030/6 "2022-06-02T05:27:08Z")

</div>

I think the alias is probably in the template you can check by just looking here

 ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bc68d630f9ff8b8be3104d2ff0730478e8d8d89f.png)

The problem at some point you deleted the alias and then started one of the metricbeat is it started to write to `metricbeat-7.17.1` which the write alias did not exist and so it started writing to a regular index named `metricbeat-7.17.1`

So to fix...

Stop all your metricbeats.

Clean up / delete the bad index  
`DELETE metricbeat-7.17.1` from the Kibana - Dev Console and YES you will lose data

Re-create the write alias

```auto
PUT metricbeat-7.17.1-000001
{
  "aliases": {
    "metricbeat-7.17.1": {
      "is_write_index": true
    }
  }
}

```

Or if you want the date component you need to do a little extra trick see [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/aliases.html)

```auto
# PUT /metricbeat-7.17.1-{now/d}-000001
PUT /%3Cmetricbeat-7.17.1-%7Bnow%2Fd%7D-000001%3E?pretty
{
  "aliases": {
    "metricbeat-7.17.1": {
      "is_write_index": true
    }
  }
}

```

Which will result in

```auto
{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "index" : "metricbeat-7.17.1-2022.06.02-000001"
}

```

---

<div class="post-metadata">

**Author:** ![Evgeny\_Barykin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evgeny_barykin/32/104350_2.png) [@Evgeny\_Barykin](https://discuss.elastic.co/u/Evgeny_Barykin)\
**Post date:** [June 2, 2022, 7:49am UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030/7 "2022-06-02T07:49:12Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2022, 9:50am UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030/8 "2022-06-30T09:50:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.