Alias field not working

Hello everyone, i'm having an issue:

When i create an alias field linking to an existing field, it creates succesfully but has no value. I create the field in the following manner:

  "deviceID": {
    "type": "alias",
    "path": "m.Device.id"
  }

I noticed one thing, my document values are all stored in the _source field (that's how they are indexed from logstash) except a date field i create using the logstash date filter. That last value goes to the "fields" section of the documents and when i create an alias of that field it works perfectly.

So, is the fact that the fields are in the _source section the problem? In that case. why can't i create an alias of a _source field?

What does your mapping for the index look like?

Here is the template settings of my indexes. Actually, there are more fields but i removed them for the sake of simplicity.

The 'DateTime' alias works perfectly, but the 'deviceID' one doesn't.

PUT _template/templatelogstash
{
  "index_patterns": ["logstash*"],
  "settings": {
    "number_of_shards": 5,
    "index.lifecycle.name": "logstash-policy"
  },
  "mappings": {
    "_source": {
      "enabled": true
    },
    "properties": {
      "m" : {
        "properties" : {
          "Conection" : {
            "properties" : {
              "Date" : {
                "type" : "date",
                "format" : "M/d/yyyy H:mm:ss Z||M/d/yyyy K:mm:ss a Z"
              }
            }
          },
          "Device" : {
            "properties" : {
              "id" : {
                "type" : "text",
                "fields" : {
                  "keyword" : {
                    "type" : "keyword",
                    "ignore_above" : 256
                  }
                }
              }
            }
          }
        }
      },
      "deviceID": {
        "type": "alias",
        "path": "m.Device.id"
      },
      "DateTime": {
        "type": "alias",
        "path": "m.Conection.Date"
      }
    }
  }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.