Winlogbeat Index not rolling over - alias not pointing to index

Elastic Stack Elasticsearch
1

Hello, I've create an ILM policy that should roll over the index when it gets to 50 GB. I then created an index template:

PUT /_template/winlogbeat-default
{
    "index_patterns" : ["winlogbeat-*"],
    "order" : 2,
    "settings" : {
        "number_of_shards" : 1,
        "number_of_routing_shards" : 1,
        "number_of_replicas" : 0,
        "index.lifecycle.name": "Policy-Winlogbeat",
        "index.lifecycle.rollover_alias": "winlogbeat"
    }
}

...and I then created the alias:

PUT winlogbeat-000001
{
  "aliases": {
    "winlogbeat": {
      "is_write_index": true
    }
  }
}

However when I start Logstash and it ingests messages, it doesn't seem to write to the initialised index (winlogbeat-000001), it just writes to the main normal index:

GET /_cat/indices/winlogbeat-*?v&s=docs.count:desc

health status index                           uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   winlogbeat-7.6.1-2020.08        JIawQ2roR_W_Sk1a_YKkrg   1   0    3102100            0      2.4gb          2.4gb
green  open   winlogbeat-000001               ViOeDT7hTIuMEWnVvMUbWA   1   0          0            0       283b           283b

...and if I use the ILM explain API I get the following error:

"index.lifecycle.rollover_alias [winlogbeat] does not point to index [winlogbeat-7.6.1-2020.08]"

From what I've found looking on various forums this problem can occur because I didn't create policy, template and alias in the correct order but I'm pretty sure I have - can anyone help?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.