Alias with multiple filters

Elastic Stack Elasticsearch
1

Hi guys,

In order to filter data to be displayed in a drop down list of the control visualization in Kibana, I decided to create an alias on my index by filtering some data but I'm facing like an issue.
Here is the part of the template

...
"aliases": {
   "filtered-data" : {
      "bool": {
         "filter": [
            { "term" : { "Type" : "Missing data" } },
            { "term" : { "Level" : "Detail" } }
         ]
      }
   }
},
...

But when I get the corresponding template, the alias contains one filter only, not both.
It works fine if I have just one filter

  1. Does alias accept multiple filters?
  2. Is this an issue to be reported?
  3. Is there any workaround regarding my need?

Thank you in advance

2

can you create a reproducible example, please? This would help a lot to fully follow the steps that you took.

Thank you!

3

For sure,

If I create this new template:

PUT _template/mytemplate
{
   "index_patterns": [ "myindex" ],
   "aliases": {
      "filtered-data" : {
         "bool": {
            "filter": [
               { "term" : { "Type" : "Missing data" } },
               { "term" : { "Level" : "Detail" } }
            ]
         }
      }
   }
}

The template is created:

GET _cat/templates/mytemplate?v
name       index_patterns order version
mytemplate [myindex]      0

And when I check its content, you can see that the alias has not been created correctly.
There is just one term filtered.

GET _template/mytemplate
{
  "mytemplate" : {
    "order" : 0,
    "index_patterns" : [ "myindex" ],
    "settings" : { },
    "mappings" : { },
    "aliases" : {
      "filtered-data" : {
        "filter" : {
          "term" : {
            "Level" : "Detail"
          }
        }
      }
    }
  }
}
4

I think your JSON structure is wrong. Try this

PUT _template/mytemplate
{
  "index_patterns": [
    "myindex"
  ],
  "aliases": {
    "filtered-data": {
      "filter": {
        "bool": {
            "filter": [
               { "term" : { "Type" : "Missing data" } },
               { "term" : { "Level" : "Detail" } }
            ]
         }
      }
    }
  }
}

However, you should get a proper exception instead of a wrongly setup alias in your case. I'll open an issue for that.

1 Like
5

I opened https://github.com/elastic/elasticsearch/issues/61009 if you want to follow

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.