# Rollover Errors

**URL:** <https://discuss.elastic.co/t/rollover-errors/325272>\
**Category:** Elasticsearch\
**Created:** [February 10, 2023, 2:07pm UTC](https://discuss.elastic.co/t/rollover-errors/325272 "2023-02-10T14:07:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\
**Post date:** [February 10, 2023, 2:07pm UTC](https://discuss.elastic.co/t/rollover-errors/325272/1 "2023-02-10T14:07:15Z")

</div>

Hello I have been working on some code to be able to rollover my syslogs so that it will continue to populate the Kibana. I am getting the following error in the Dev Tools

```auto
Illegal argument exception
rollover target is a [conrete index] but one of [alias, data_stream] was expected
status 400

```

What I have entered is the following

```auto
POST /syslog-YYYY.MM.dd/_rollover/syslog_2022

```

Where I have the actual date and not the YYYY.MM.dd in the command. When I run the command as

```auto
POST /syslog-YYYY.MM.dd/_rollover/syslog_2022

```

I receive a different error indicating that there is no such index.

What am I doing incorrectly to ensure that this will roll over and continue to gather and collect syslogs?

I do appreciate all of your Elastic Guru knowledge and support.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 12, 2023, 5:14pm UTC](https://discuss.elastic.co/t/rollover-errors/325272/2 "2023-02-12T17:14:38Z")

</div>

What version are you using ?

And it looks like you are using indexes and not a data streams. Is that correct ?

The key question is whether you're actually using aliases and rollovers? Or they're just being time-based indices?.

Did you set up a write alias?

> **[Tutorial: Automate rollover with ILM | Elasticsearch Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/getting-started-index-lifecycle-management.html#ilm-gs-alias-bootstrap)**

If so You don't rollover the actual index, you POST rollover to the write alias, which knows the current index the alias is pointing to and then creates a new index and then points the alias to the new index

> **[Rollover API | Elasticsearch Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/indices-rollover-index.html)**

---

<div class="post-metadata">

**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\
**Post date:** [March 1, 2023, 4:23pm UTC](https://discuss.elastic.co/t/rollover-errors/325272/3 "2023-03-01T16:23:34Z")

</div>

Hello Stephen;

thank you for the reply. I am using 7.13.4 version of Elastic. Yes I am using indices over streams. I an going to go through the tutorials you have linked in your response.

I appreciate the guidance.

MKirby

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2023, 4:23pm UTC](https://discuss.elastic.co/t/rollover-errors/325272/4 "2023-03-29T16:23:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.