尾巴;

根据文件：
数据流需要匹配的索引模板。
您的索引名称似乎与群集上的任何可用模板都不匹配。

溶液：

遵循文档：
创建ILM策略

PUT _ilm/policy/winlog-lifecycle-policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_primary_shard_size": "50gb"
          }
        }
      },
      "warm": {
        "min_age": "30d",
        "actions": {
          "shrink": {
            "number_of_shards": 1
          },
          "forcemerge": {
            "max_num_segments": 1
          }
        }
      },
      "cold": {
        "min_age": "60d",
        "actions": {
          "searchable_snapshot": {
            "snapshot_repository": "found-snapshots"
          }
        }
      },
      "frozen": {
        "min_age": "90d",
        "actions": {
          "searchable_snapshot": {
            "snapshot_repository": "found-snapshots"
          }
        }
      },
      "delete": {
        "min_age": "735d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

然后创建与您的索引名称匹配的模板：

PUT _index_template/my-index-template
{
  "index_patterns": ["my-data-stream*"],
  "data_stream": { },
  "template": {
    "settings": {
      "lifecycle": {
        "name": "winlog-lifecycle-policy"
      }
    }
  },
  "priority": 500,
  "_meta": {
    "description": "Template for my winlog data"
  }
}

和一个与您的索引/数据流名称匹配的模板。