Automatically apply filtered alias for daily indices

[YvorL]

Hi!

I'm currently adding rollup jobs where filtering isn't an option. I have various cases, some would be a simple match for one field (I'd monitor the count), others would require bucketing, cardinality and a final sum aggregation on those. The extent of Elasticsearch's capability and built-in features always amazes me and I learn a new thing every week. Today I stumbled upon filtered aliases. As far as I got it seems, that - without adding an extra tool (e.g., Curator plugin) to the stack - I can't add a "view" for a daily index. I don't want to apply the view for all indices because that'd be a huge waste of resources (one index ~150GB).
The question would be if there's a way in Elasticsearch to automatically add a filtered alias to daily indices?

Thank you!

[theuntergeek (Aaron Mildenstein)]

@YvorL

[Is there] a way in Elasticsearch to automatically add a filtered alias to daily indices?

You can add a filtered alias to an index template. It would be available at index creation time.

PUT _template/template_1
{
    "index_patterns" : ["te*"],
    "settings" : {
        "number_of_shards" : 1
    },
    "aliases" : {
        "alias1" : {},
        "alias2" : {
            "filter" : {
                "term" : {"user" : "kimchy" }
            },
            "routing" : "kimchy"
        },
        "{index}-alias" : {} 
    }
}

Every new index created that matches index_pattern will get the filtered alias.

[YvorL]

Thanks! Will check it in the upcoming days!

Have a great day !