ES 6.4.0 Field aliases

[ld_pvl]

Hi Team,

I would like to find out more about how the new field aliases feature works in ES 6.4.0 as the docs seem to be not yet up-to-date.

According to this issue #23714, there is now a new field type called alias and we can create a new field alias like so:

PUT my_index
{
  "mappings": {
    "my_type": {
      "properties": {
        "host": {
          "properties": {
            "source_ip": {
              "type": "ip"
            }
          }
        },
        "sourceIP": {
          "type": "alias",
          "path": "host.source_ip"
        }
      }
    }
  }
}

Can this be applied to existing indexes? If so, what is the recommended way of doing this - can we just apply the settings on the fly or do we need to close the index, apply the settings then reopen?

Many thanks for your help,

[warkolm (Mark Walkom)]

You can apply it to existing indices, as long as you don't change any of the existing mappings.

[ld_pvl]

That's great, thanks!