# Index Management question **URL:** \ **Category:** Index Management\ **Created:** [November 16, 2020, 3:19pm UTC](https://forum.opensearch.org/t/index-management-question/4212 "2020-11-16T15:19:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jberto78](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jberto78](https://forum.opensearch.org/u/jberto78)\ **Post date:** [November 16, 2020, 3:19pm UTC](https://forum.opensearch.org/t/index-management-question/4212/1 "2020-11-16T15:19:17Z")
I’m trying to set up a policy which deletes indexes after 3 days. I’ve looked at the documentation [here](https://opendistro.github.io/for-elasticsearch-docs/docs/ism/) but I’m still getting an error when trying to apply the policy. Below is my IM policy I set up. ```auto { "policy": { "policy_id": "common-lateattach-delete", "description": "open warm delete workflow", "last_updated_time": 1605293466946, "schema_version": 1, "error_notification": null, "default_state": "open", "states": [ { "name": "open", "actions": [ { "rollover": { "min_index_age": "1d" } } ], "transitions": [ { "state_name": "warm" } ] }, { "name": "warm", "actions": [ { "replica_count": { "number_of_replicas": 5 } } ], "transitions": [ { "state_name": "delete", "conditions": { "min_index_age": "3d" } } ] }, { "name": "delete", "actions": [ { "notification": { "destination": { "chime": { "url": "https://hooks.slack.com/services/##########" } }, "message_template": { "source": "The index {{ctx.index}} is being deleted", "lang": "mustache" } } }, { "delete": {} } ], "transitions": [] } ] } } ``` Below is the template I have applied to my indexes. ```auto { "lateattach_common" : { "order" : 0, "index_patterns" : [ "lateattach-common-*" ], "settings" : { "index" : { "opendistro" : { "index_state_management" : { "policy_id" : "common-lateattach-delete" } } } }, "mappings" : { "properties" : { "@timestamp" : { "type" : "date" } } }, "aliases" : { "live" : { } } } } ``` When the IM policy tries to implement a change, I see the following error. ```auto "info" : { "message" : "Missing rollover_alias index setting [index=lateattach-common-2020.11.16]" } ``` What am I missing in my policy that is preventing it from doing the rollover and then deleting the index? ---
**Author:** ![dbbaughe](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dbbaughe](https://forum.opensearch.org/u/dbbaughe)\ **Post date:** [November 16, 2020, 11:42pm UTC](https://forum.opensearch.org/t/index-management-question/4212/2 "2020-11-16T23:42:49Z")
Hey @jberto78, Rollover operates on an _alias_ , rather than an index. And because an index can have multiple aliases, you need to provide ISM enough information to know _which_ alias it should be rolling over. The way to do that is through another index level setting `"opendistro.index_state_management.rollover_alias": "some_alias"`. You can add this to your index template in the same place as the policy\_id one. This should be the alias that you want to be rolled over, so every new index will automatically have this setting and know this is the alias to actually rollover. When you create your first index for this index group, you will need to bootstrap it with the alias you configured. ---
**Author:** ![jberto78](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jberto78](https://forum.opensearch.org/u/jberto78)\ **Post date:** [November 19, 2020, 3:21pm UTC](https://forum.opensearch.org/t/index-management-question/4212/3 "2020-11-19T15:21:41Z")
Hi @dbbaughe, I did as you recommended and initially it appears to have worked (I didn’t get the “missing rollover\_alias” message). But now I have the below error when the policy tries to rollover the index (see below). I do see that the policy is trying to connect to our instance on port 9300 but since we’re running on AWS Elasticsearch I don’t have that port open. Can that be configured to use a different port? ```auto { "cause": "[c94c772aaf871a37ca3be1658beb9435][x.x.x.x:9300][indices:admin/rollover]", "message": "Failed to rollover index [index=index_name-2020.11.18]" } ``` ---
**Author:** ![tony](https://avatars.discourse-cdn.com/v4/letter/t/ee7513/32.png) [@tony](https://forum.opensearch.org/u/tony)\ **Post date:** [November 23, 2020, 10:34am UTC](https://forum.opensearch.org/t/index-management-question/4212/4 "2020-11-23T10:34:33Z")
Does the user that is running the policy have the rights (admin/rollover) on the index? ---
**Author:** ![jberto78](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jberto78](https://forum.opensearch.org/u/jberto78)\ **Post date:** [November 24, 2020, 6:47pm UTC](https://forum.opensearch.org/t/index-management-question/4212/5 "2020-11-24T18:47:51Z")
I don’t have it set to run as a specific user, so I guess it would be under the admin user? Is there a default user that Index Management runs under when trying to rollover or delete an index? Is there a way I can check what user the script ran under? ---
**Author:** ![dbbaughe](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dbbaughe](https://forum.opensearch.org/u/dbbaughe)\ **Post date:** [November 24, 2020, 9:26pm UTC](https://forum.opensearch.org/t/index-management-question/4212/6 "2020-11-24T21:26:36Z")
Hey @jberto78, Could you cut a support ticket for AWS, there was a bug with the handling of exceptions in rollover specifically which is why you’re not seeing the actual error. Need support to check out the logs in elasticsearch.log to tell you explicitly why it failed which will be a bit better than guessing.