There are some way to fix is_write_index=false for all my indexes?

[David_Oceans]

Hi,

I found the cluster unhealthy due to a space problem.
I have deleted some old indexes and restarted the elastic and now it is healthy
However, my filebeat agents when they try to write tells them

2019-12-23T08:27:17.595Z ERROR elasticsearch/client.go:343 Failed to perform any bulk index operations: 400 Bad Request: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"no write index is defined for alias [xxxxx]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"}],"type":"illegal_argument_exception","reason":"no write index is defined for alias [xxxxx]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"},"status":400}

How can I solve this quickly and for all my indexes? is there any command?

Thank you so much!

[gbrown (Gordon Brown)]

This isn't a problem to be fixed on all your indices - you'll only need to fix one. In particular, you'll need to determine which index new data should be written to - this is probably the newest one for your version of Filebeat. You could also create a new one.

Once you've found that index, you'll need to use the Update Index Aliases API to configure that index with the alias filebeat-<VERSION> (fill in whatever your Filebeat version is there, or whatever index name you're using if not the standard Filebeat names) with "is_write_index" : true similar to the examples in the docs section linked above.

You should probably then check that ILM is working properly for that index (and your other indices, but that index in particular) using the ILM explain API, as sometimes it can encounter an error if the aliases get messed up. If ILM for that index is an error state, try the Retry ILM policy API, which will likely get it straightened out. If not, post the output of the Explain API here and I'll do my best to help out.