# Rollover of indices doesn't work any more **URL:** \ **Category:** Kibana\ **Created:** [July 11, 2023, 8:29am UTC](https://discuss.elastic.co/t/rollover-of-indices-doesnt-work-any-more/338075 "2023-07-11T08:29:41Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ronin667](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ronin667/32/123272_2.png) [@ronin667](https://discuss.elastic.co/u/ronin667)\ **Post date:** [July 11, 2023, 8:29am UTC](https://discuss.elastic.co/t/rollover-of-indices-doesnt-work-any-more/338075/1 "2023-07-11T08:29:41Z")
Hi community, we're running an Elastic Cloud cluster with Elasticsearch and Kibana that has been giving us some trouble in the last few weeks. After our cluster ran out of storage a few weeks ago, the cluster stopped accepting write operations. This had happened before and we had fixed it by setting `"index.blocks.read_only_allow_delete"` to `null` in `/_all/_settings`. This time, however, our Logstash instance that is feeding messages to Elasticsearch continued receiving error messages, saying that indices can't be written to since no index is marked the write-to index. Trying to set `is_write_index` to true for the latest index didn't work, so we ended up deleting most of our indices and re-creating them. All our indices follow the naming scheme \-\-\-\, and the rollover alias is \-\. For example: ```auto PUT %3Cprod-maiconnect-%7Bnow%2Fd%7D-000001%3E { "aliases" : { "prod-maiconnect" : {} }, "mappings" : { "properties" : { "@timestamp" : { "type" : "date" }, "@version" : { "type" : "keyword" }, "contextMap" : { "dynamic" : "false", "properties" : { "request_id" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } }, "norms" : false }, "user" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } }, "norms" : false }, // ... lots of more properties redacted } }, "endOfBatch" : { "type" : "boolean" }, "environment" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "event" : { "properties" : { "original" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } }, "host" : { "properties" : { "ip" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } }, "instant" : { "properties" : { "epochSecond" : { "type" : "long" }, "nanoOfSecond" : { "type" : "long" } } }, "level" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } }, "norms" : false }, "loggerFqcn" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "loggerName" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } }, "norms" : false }, "marker" : { "properties" : { "name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } } } }, "marker_name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } }, "norms" : false }, "message" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } }, "norms" : false }, "message_length" : { "type" : "long" }, "thread" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "threadId" : { "type" : "long" }, "threadPriority" : { "type" : "long" }, "thrown" : { "dynamic" : "false", "properties" : { "message" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } }, "norms" : false }, "name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } }, "norms" : false } } } } }, "settings" : { "index" : { "refresh_interval" : "30s", "blocks" : { "read_only_allow_delete" : "false" }, "priority" : "50", "number_of_replicas" : "0", "lifecycle" : { "name" : "prod", "rollover_alias" : "prod-maiconnect", "indexing_complete" : "true" }, "highlight" : { "max_analyzed_offset" : "7000000" }, "routing" : { "allocation" : { "include" : { "_tier_preference" : "data_warm,data_hot" } } }, "number_of_shards" : "1" } } } ``` Then, an index with the current date and given number is created and is being written to under the given alias. However, after some time we observe one of the following three erroneous behaviours: - Either, the index doesn't roll over at all; Elasticsearch keeps writing the messages to the index with the date and number of when it was created, and the index grows and grows until we get disk space problems again. - Or, when the index is supposed to roll over, it simply disappears, and as soon as the next incoming message is processed, a new index is created that is named like the rollover alias. This index then goes into error state with this message: ```auto Index lifecycle error illegal_argument_exception: index.lifecycle.rollover_alias [prod-maiconnect-*] does not point to index [prod-maiconnect] ``` - Or, the index does roll over successfully, however the new index has is\_write\_index = false and we get this error: ```auto illegal_argument_exception: index [prod-maiconnect-2023.06.11-000008] is not the write index for alias [prod-maiconnect] ``` We manually set the index to be the write index for this alias, but after the next rollover, it may show the same behaviour again, or one of the other 2 erroneous behaviours detailed above. We tried to delete and re-create the indices multiple times, but we always end up with the same problem. Does anyone have a hint what we could do? ---
**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\ **Post date:** [July 12, 2023, 11:54pm UTC](https://discuss.elastic.co/t/rollover-of-indices-doesnt-work-any-more/338075/2 "2023-07-12T23:54:46Z")
Your Elastic Cloud support team can help: [https://www.elastic.co/support/welcome/cloud#how-to-open-case](https://www.elastic.co/support/welcome/cloud#how-to-open-case) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 9, 2023, 11:54pm UTC](https://discuss.elastic.co/t/rollover-of-indices-doesnt-work-any-more/338075/3 "2023-08-09T23:54:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.