# GET /\_alias/foo\* returns unrelated aliases
**URL:** https://discuss.elastic.co/t/get-alias-foo-returns-unrelated-aliases/377889
**Category:** Elastic Search
**Created:** [May 7, 2025, 8:45am UTC](https://discuss.elastic.co/t/get-alias-foo-returns-unrelated-aliases/377889 "2025-05-07T08:45:25Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Richard\_Zhang](https://discuss.elastic.co/u/Richard_Zhang)
#### Post date: [May 7, 2025, 8:45am UTC](https://discuss.elastic.co/t/get-alias-foo-returns-unrelated-aliases/377889/1 "2025-05-07T08:45:25Z")
Hi everyone,
when I run this query and no matches aliases exist, the request returns unrelated aliases, it seems to be often **elastic-cloud-logs-8**. Could you help advise? Thanks.
Two questions:
1. Why it returns unrelated aliases? expected result is empty
2. How does ES server decide which alias to return if no matches are found?
```auto
GET /_alias/foo*
```
Response:
```auto
{
"elastic-cloud-logs-8": {
"aliases": {
"filebeat-elastic-cloud-logs-8": {}
}
}
}
```
---
### Author:  [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [May 20, 2025, 7:09am UTC](https://discuss.elastic.co/t/get-alias-foo-returns-unrelated-aliases/377889/2 "2025-05-20T07:09:18Z")
Hello,
I am not sure if this is the expected behavior if the alias does not exists.
Example i checked below :
If alias is found -
```auto
GET /_alias/f_*
output :
{
"flights": {
"aliases": {
"f_alias": {}
}
},
"flights-2": {
"aliases": {
"f_alias": {}
}
}
}
```
If alias is not found -
```auto
GET /_alias/foo*
output :
{}
```
Could you please check using below command if there is any foo\* alias available in your environment -
```auto
GET /_cat/aliases?v
```
Thanks!!
---
### Author:  [@Richard\_Zhang](https://discuss.elastic.co/u/Richard_Zhang)
#### Post date: [May 30, 2025, 9:48am UTC](https://discuss.elastic.co/t/get-alias-foo-returns-unrelated-aliases/377889/3 "2025-05-30T09:48:06Z")
Hi @Tortoise
when I run `GET /_cat/aliases?v` a lot of aliases are returned but no **foo** \* alias in the list.
and, even `filebeat-elastic-cloud-logs-8` is **NOT** in the result. this looks like a bug.
while this request `GET /_alias/filebeat-elastic-cloud-logs-8` returns correct result, when I run `GET /_cat/aliases/filebeat*?v` it returns nothing. this is **incorrect** also.
when you run `GET /_alias/foo*` in your ES cluster it returns empty result. this seems right but it could be because there is no this alias `filebeat-elastic-cloud-logs-8` in your cluster (I mean if you have this alias, it will wrongly returns it). Could you check if it's this case by `GET /_alias/filebeat-elastic-cloud-logs-8`? Thanks.
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [May 30, 2025, 11:52am UTC](https://discuss.elastic.co/t/get-alias-foo-returns-unrelated-aliases/377889/4 "2025-05-30T11:52:27Z")
Er, I cant reproduce this either.
Are you doing the `GET /_alias/foo*` in Kibana Dev Tools? Or via some other tool?
---
### Author:  [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [May 30, 2025, 1:24pm UTC](https://discuss.elastic.co/t/get-alias-foo-returns-unrelated-aliases/377889/5 "2025-05-30T13:24:50Z")
Hello @Richard_Zhang
These are my findings :
`GET _alias`
This command list all the alias & I am able to find my created alias as well as filebeat alias in this output.
Example output in JSON extracted 3 aliases :
```auto
"elastic-cloud-logs-8": {
"aliases": {
"filebeat-elastic-cloud-logs-8": {}
}
"kibana_sample_data_logs": {
"aliases": {
"kibana_logs_alias": {}
}
}
"kibana_demo": {
"aliases": {
"kib_demo": {
"is_write_index": true
}
}
}
```
If i add any property like is\_write\_index =\> this alias is visible in
```auto
GET /_cat/aliases?v
POST /_aliases
{
"actions": [
{
"add": {
"index": "kibana_demo",
"alias": "kib_demo",
"is_write_index": true
}
}
]
}
GET /_cat/aliases?v
```
**Output :**
_alias index filter routing.index routing.search is\_write\_index_
_kib\_demo kibana\_demo - - - TRUE_
The 1 created before (_kibana\_logs\_alias_) is not visible (_GET /\_cat/aliases?v_) as it was set with no properties.
I am not sure if below can be the reason :
The alias appears without additional configurations such as filters, routing or write index settings, which is why it seems "blank" in terms of these additional settings.
Someone from elastic can confirm this behavior.
Thanks!!
---
### Author:  [@Richard\_Zhang](https://discuss.elastic.co/u/Richard_Zhang)
#### Post date: [June 3, 2025, 3:08am UTC](https://discuss.elastic.co/t/get-alias-foo-returns-unrelated-aliases/377889/6 "2025-06-03T03:08:50Z")
Hi @RainTown yes, I run the query in Kibana Dev Tools
---
### Author:  [@Richard\_Zhang](https://discuss.elastic.co/u/Richard_Zhang)
#### Post date: [June 9, 2025, 6:10am UTC](https://discuss.elastic.co/t/get-alias-foo-returns-unrelated-aliases/377889/7 "2025-06-09T06:10:44Z")
Thanks for the detailed explanation.
I Just raised an issue on Github for this unexpected behavior
>
>
> \### Elasticsearch Version
>
> 8.11.1
>
> \### Installed Plugins
>
> \_No response\_
>
> \### Jav…a Version
>
> \_bundled\_
>
> \### OS Version
>
> N/A
>
> \### Problem Description
>
> When I run this query \`GET /\_alias/foo\*\` and no matches, the request returns unrelated aliases, it seems to be often \`filebeat-elastic-cloud-logs-8\`.
>
> When I run \`GET /\_cat/aliases/filebeat\*?v\`, the filebeat alias should be a match but this query returns nothing.
>
> Why is this alias "filebeat-elastic-cloud-logs-8" should special? it has unexpected behavior in both api \`/\_alias/\` and \`/\_cat/aliases/\`
>
>
> \### Steps to Reproduce
>
> Run the two queries in Kibana Dev Tools
>
> \`GET /\_alias/foo\*\`
>
> \`\`\`json
> {
> "elastic-cloud-logs-8": {
> "aliases": {
> "filebeat-elastic-cloud-logs-8": {}
> }
> }
> }
> \`\`\`
>
> \`GET /\_cat/aliases/filebeat\*?v\`
> \`\`\`
> alias index filter routing.index routing.search is\_write\_index
> \`\`\`
>
> \### Logs (if relevant)
>
> \_No response\_