# There are some way to fix is\_write\_index=false for all my indexes?

**URL:** <https://discuss.elastic.co/t/there-are-some-way-to-fix-is-write-index-false-for-all-my-indexes/212823>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [December 23, 2019, 8:52am UTC](https://discuss.elastic.co/t/there-are-some-way-to-fix-is-write-index-false-for-all-my-indexes/212823 "2019-12-23T08:52:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Oceans](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_oceans/32/51452_2.png) [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\
**Post date:** [December 23, 2019, 8:52am UTC](https://discuss.elastic.co/t/there-are-some-way-to-fix-is-write-index-false-for-all-my-indexes/212823/1 "2019-12-23T08:52:06Z")

</div>

Hi,

I found the cluster unhealthy due to a space problem.  
I have deleted some old indexes and restarted the elastic and now it is healthy  
However, my filebeat agents when they try to write tells them

` 2019-12-23T08:27:17.595Z ERROR elasticsearch/client.go:343 Failed to perform any bulk index operations: 400 Bad Request: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"no write index is defined for alias [xxxxx]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"}],"type":"illegal_argument_exception","reason":"no write index is defined for alias [xxxxx]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"},"status":400}`

How can I solve this quickly and for all my indexes? is there any command?

Thank you so much!

---

<div class="post-metadata">

**Author:** ![gbrown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gbrown/32/34482_2.png) [@gbrown](https://discuss.elastic.co/u/gbrown)\
**Post date:** [December 23, 2019, 11:55pm UTC](https://discuss.elastic.co/t/there-are-some-way-to-fix-is-write-index-false-for-all-my-indexes/212823/2 "2019-12-23T23:55:36Z")

</div>

This isn't a problem to be fixed on all your indices - you'll only need to fix one. In particular, you'll need to determine which index new data should be written to - this is probably the newest one for your version of Filebeat. You could also create a new one.

Once you've found that index, you'll need to use the [Update Index Aliases API](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/indices-aliases.html#aliases-write-index) to configure that index with the alias `filebeat-<VERSION>` (fill in whatever your Filebeat version is there, or whatever index name you're using if not the standard Filebeat names) with `"is_write_index" : true` similar to the examples in the docs section linked above.

You should probably then check that ILM is working properly for that index (and your other indices, but that index in particular) using the [ILM explain API](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/ilm-explain-lifecycle.html), as sometimes it can encounter an error if the aliases get messed up. If ILM for that index is an error state, try the [Retry ILM policy API](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/ilm-retry-policy.html), which will likely get it straightened out. If not, post the output of the Explain API here and I'll do my best to help out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 20, 2020, 11:55pm UTC](https://discuss.elastic.co/t/there-are-some-way-to-fix-is-write-index-false-for-all-my-indexes/212823/3 "2020-01-20T23:55:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
