Rollover says it's successful but I can't access new index

[patrickbot1 (Patrick)]

I use the logstash plugin that's part of Cloudbees Jenkins. It sends all of the logs into one single logstash* index. I'd like to be able to perform a rollover on that index to where it won't have more than 1 month of data in it.

I first made sure that the logstash index has an alias:

POST /_aliases
{
"actions" : [
{ "add" : { "index" : "logstash*", "alias" : "currentagain" } }
]
}

That seemed to work.

I then did this:

POST /current/_rollover/testrollagain
{
"conditions": {
"max_age": "7d"
}
}

That seems to work as well as I get this message:

{
"old_index": "logstash",
"new_index": "testrollagain",
"rolled_over": true,
"dry_run": false,
"acknowledged": true,
"shards_acknowledged": true,
"conditions": {
"[max_age: 7d]": true
}
}

However, I can't create the new testrollagain index and can't seem to access anything in it. Am I missing something?

[spinscale (Alexander Reelsen)]

I do not fully understand what you are after here. First, can you provide a fully reproducible example? This one changes its alias name from currentagain to current between the calls and I would like to be sure what names you used to avoid confusion.

The rollover call points the index to the new testrollagain index. has this index been created before? if security is enabled, do you have permissions?

Please note that you cannot point an alias to other aliases if that is what you are after. If not please take some more time to explain what is an index, what is an alias, and what behavour you are expecting plus error messages from those actions that you are trying to execute.

Thanks!

[patrickbot1 (Patrick)]

logstash* - This is the large index I want to split into smaller chunks where I can delete older data. This data automatically gets shipped over to elasticsearch through the logstash plugin that's provided.

logstash* also didn't have an alias so I ran this to give it an alias:

POST /_aliases
{
"actions" : [
{ "add" : { "index" : "logstash*", "alias" : "currentagain" } }
]
}

After that, the logstash* index has an alias of currentagain.

This index has about 6 months worth of Jenkins data. I'd like to figure out a way to split things up to where logstash* only has 5 months of data, by pushing the oldest 1 month to a new index. How would I do that from this step?

I figured out how to use delete by query, but I've read that's not considered good practice. I'd like to do rollovers the right way.