It's pretty common that we see issues around ILM where users have deleted their write alias causing running beats instances to auto-create an index where the write alias should (with auto-mappings to boot, since the template won't be applied).

We could easily fix this by setting require_alias=true in the bulk requests, which is documented here. Even though we're currently moving toward fleet and data streams, this will still help a lot of users since that change over will take some time.

I've marked this as a bug since the current behavior really is broken IMHO.

CC @ruflin @kvch