Alias with multiple filters

Hi guys,

In order to filter data to be displayed in a drop down list of the control visualization in Kibana, I decided to create an alias on my index by filtering some data but I'm facing like an issue.
Here is the part of the template

...
"aliases": {
   "filtered-data" : {
      "bool": {
         "filter": [
            { "term" : { "Type" : "Missing data" } },
            { "term" : { "Level" : "Detail" } }
         ]
      }
   }
},
...

But when I get the corresponding template, the alias contains one filter only, not both.
It works fine if I have just one filter

  1. Does alias accept multiple filters?
  2. Is this an issue to be reported?
  3. Is there any workaround regarding my need?

Thank you in advance

can you create a reproducible example, please? This would help a lot to fully follow the steps that you took.

Thank you!

For sure,

If I create this new template:

PUT _template/mytemplate
{
   "index_patterns": [ "myindex" ],
   "aliases": {
      "filtered-data" : {
         "bool": {
            "filter": [
               { "term" : { "Type" : "Missing data" } },
               { "term" : { "Level" : "Detail" } }
            ]
         }
      }
   }
}

The template is created:

GET _cat/templates/mytemplate?v
name       index_patterns order version
mytemplate [myindex]      0     

And when I check its content, you can see that the alias has not been created correctly.
There is just one term filtered.

GET _template/mytemplate
{
  "mytemplate" : {
    "order" : 0,
    "index_patterns" : [ "myindex" ],
    "settings" : { },
    "mappings" : { },
    "aliases" : {
      "filtered-data" : {
        "filter" : {
          "term" : {
            "Level" : "Detail"
          }
        }
      }
    }
  }
}

I think your JSON structure is wrong. Try this

PUT _template/mytemplate
{
  "index_patterns": [
    "myindex"
  ],
  "aliases": {
    "filtered-data": {
      "filter": {
        "bool": {
            "filter": [
               { "term" : { "Type" : "Missing data" } },
               { "term" : { "Level" : "Detail" } }
            ]
         }
      }
    }
  }
}

However, you should get a proper exception instead of a wrongly setup alias in your case. I'll open an issue for that.

1 Like

I opened https://github.com/elastic/elasticsearch/issues/61009 if you want to follow

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.