GET /_alias/foo* returns unrelated aliases

Elastic Search
1

Hi everyone,

when I run this query and no matches aliases exist, the request returns unrelated aliases, it seems to be often elastic-cloud-logs-8. Could you help advise? Thanks.

Two questions:

  1. Why it returns unrelated aliases? expected result is empty
  2. How does ES server decide which alias to return if no matches are found?
GET /_alias/foo*

Response:

{
  "elastic-cloud-logs-8": {
    "aliases": {
      "filebeat-elastic-cloud-logs-8": {}
    }
  }
}
2

Hello,

I am not sure if this is the expected behavior if the alias does not exists.

Example i checked below :
If alias is found -

GET /_alias/f_*
output :
{
  "flights": {
    "aliases": {
      "f_alias": {}
    }
  },
  "flights-2": {
    "aliases": {
      "f_alias": {}
    }
  }
}

If alias is not found -

GET /_alias/foo*
output :
{}

Could you please check using below command if there is any foo* alias available in your environment -


GET /_cat/aliases?v

Thanks!!

3

Hi @Tortoise

when I run GET /_cat/aliases?v a lot of aliases are returned but no foo* alias in the list.

and, even filebeat-elastic-cloud-logs-8 is NOT in the result. this looks like a bug.

while this request GET /_alias/filebeat-elastic-cloud-logs-8 returns correct result, when I run GET /_cat/aliases/filebeat*?v it returns nothing. this is incorrect also.

when you run GET /_alias/foo* in your ES cluster it returns empty result. this seems right but it could be because there is no this alias filebeat-elastic-cloud-logs-8 in your cluster (I mean if you have this alias, it will wrongly returns it). Could you check if it's this case by GET /_alias/filebeat-elastic-cloud-logs-8? Thanks.

4

Er, I cant reproduce this either.

Are you doing the GET /_alias/foo* in Kibana Dev Tools? Or via some other tool?

5

Hello @Richard_Zhang

These are my findings :

GET _alias
This command list all the alias & I am able to find my created alias as well as filebeat alias in this output.

Example output in JSON extracted 3 aliases :

"elastic-cloud-logs-8": {
  "aliases": {
    "filebeat-elastic-cloud-logs-8": {}
  }
	
"kibana_sample_data_logs": {
  "aliases": {
    "kibana_logs_alias": {}
  }
}

"kibana_demo": {
  "aliases": {
    "kib_demo": {
      "is_write_index": true
    }
  }
}

If i add any property like is_write_index => this alias is visible in

GET /_cat/aliases?v

POST /_aliases
{
  "actions": [
    {
      "add": {
        "index": "kibana_demo",
        "alias": "kib_demo",
        "is_write_index": true
      }
    }
  ]
}

GET /_cat/aliases?v

Output :

alias index filter routing.index routing.search is_write_index
kib_demo kibana_demo - - - TRUE

The 1 created before (kibana_logs_alias) is not visible (GET /_cat/aliases?v) as it was set with no properties.

I am not sure if below can be the reason :
The alias appears without additional configurations such as filters, routing or write index settings, which is why it seems "blank" in terms of these additional settings.

Someone from elastic can confirm this behavior.

Thanks!!

1 Like
6

Hi @RainTown yes, I run the query in Kibana Dev Tools

7

Thanks for the detailed explanation.

I Just raised an issue on Github for this unexpected behavior

2 Likes