# Two ILM errors - does not point to a write index and does not point to index

**URL:** <https://discuss.elastic.co/t/two-ilm-errors-does-not-point-to-a-write-index-and-does-not-point-to-index/275461>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [June 9, 2021, 3:20pm UTC](https://discuss.elastic.co/t/two-ilm-errors-does-not-point-to-a-write-index-and-does-not-point-to-index/275461 "2021-06-09T15:20:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![parthmaniar](https://avatars.discourse-cdn.com/v4/letter/p/71e660/32.png) [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Post date:** [June 9, 2021, 3:20pm UTC](https://discuss.elastic.co/t/two-ilm-errors-does-not-point-to-a-write-index-and-does-not-point-to-index/275461/1 "2021-06-09T15:20:48Z")

</div>

I am having two ILM errors **for different indexes.**

**My primary error** was (and is for the indices where I have not carried our steps mentioned below).

`illegal_argument_exception: index.lifecycle.rollover_alias "indice name" does not point to index "rollover indice name"`

For these indices I could see that there was no aliases.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/0/c0fccba67deb126f1bf5c760aae7c4781be0feb9.png)

Hence I created an aliases using:

```auto
POST /_aliases
{
  "actions" : [
    { "add" : { "index" : "auditbeat-7.13.0-*", "alias" : "auditbeat-7.13.0" }
    }
  ]
}

```

However on indexes where Aliases is present, I get the error: **(secondary error)**

`illegal_argument_exception: rollover target [auditbeat-7.13.1] does not point to a write index`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75b34295a7664d3ae4ed0c30638c275af15b9024.png)

I am using logstash to collect and forward the logs to Elasticsearch. Here is the output portion of the configuration from Logstash's beats.conf

```auto
output {
  elasticsearch {
    hosts => ["ES_IP_1:9200","ES_IP_2:9200"]
    ssl => true
    user => 'redacted'
    password => 'redacted'
    cacert => '/etc/logstash/elasticsearch-ca.pem'
    ssl_certificate_verification => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    ilm_enabled => auto
  }
}

```

I can see following logs in /var/log/syslog

```auto
(status=400): {"type":"illegal_argument_exception","reason":"no write index is defined for alias [auditbeat-7.13.1]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"}

```

I have tried adding parameter is\_write\_index : true **but that hasn't solved the problem.**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed071a0cf07f0c27f98ffd5bc637cc219daeedf8.png)

I have created new ILM policies too but same problem continues ([Tutorial: Automate rollover with ILM | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html))

Where am I going wrong and how do I fix this?

_PS: There is something weird wherein at times there are **no indices** with ILM error but I reckon that can be ignored until I fix the problem 🙂_

---

<div class="post-metadata">

**Author:** ![parthmaniar](https://avatars.discourse-cdn.com/v4/letter/p/71e660/32.png) [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Post date:** [June 24, 2021, 2:01pm UTC](https://discuss.elastic.co/t/two-ilm-errors-does-not-point-to-a-write-index-and-does-not-point-to-index/275461/2 "2021-06-24T14:01:39Z")

</div>

A bump to the thread in case someone in the community could kindly assist?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2021, 2:02pm UTC](https://discuss.elastic.co/t/two-ilm-errors-does-not-point-to-a-write-index-and-does-not-point-to-index/275461/3 "2021-07-22T14:02:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.