There are some way to fix is_write_index=false for all my indexes?

This isn't a problem to be fixed on all your indices - you'll only need to fix one. In particular, you'll need to determine which index new data should be written to - this is probably the newest one for your version of Filebeat. You could also create a new one.

Once you've found that index, you'll need to use the Update Index Aliases API to configure that index with the alias filebeat-<VERSION> (fill in whatever your Filebeat version is there, or whatever index name you're using if not the standard Filebeat names) with "is_write_index" : true similar to the examples in the docs section linked above.

You should probably then check that ILM is working properly for that index (and your other indices, but that index in particular) using the ILM explain API, as sometimes it can encounter an error if the aliases get messed up. If ILM for that index is an error state, try the Retry ILM policy API, which will likely get it straightened out. If not, post the output of the Explain API here and I'll do my best to help out.

2 Likes