This is the error I am getting on the indices that fluentd is sending directly to Elasticsearch:
illegal_argument_exception: index.lifecycle.rollover_alias [logstash] does not point to index [logstash-2021.02.09]
The indices are daily and have the format "logstash-YYYY.MM.DD" (i.e. logstash-2021.03.17), so I end up with one index per day, i.e.:
logstash-2021.03.17 logstash-2021.03.16 logstash-2021.03.15 logstash-2021.03.14 logstash-2021.03.13 logstash-2021.03.12 [...]
I am wondering how I can set the "logstash" alias to rollover the daily index if it matches the ILM policy rules AND also apply automatically the logstash alias on the new daily indices automatically.
For example, if I set my "logstash-policy" ILM to rollover when the daily index reaches 1GB in size, I'd like it to rotate to "logstash-2021.03.17-000002" for today, as an example. I would also lie to have tomorrow's index "logstash-2021.03.18" to automatically get the "logstash" alias attached to it when it gets created and also rollover automatically as per the "Logstash-policy" ILM.
Can you help me with steps to modify my infrastructure to set those automatically.