# How to update alias to capture new matching index patterns?

**URL:** <https://discuss.elastic.co/t/how-to-update-alias-to-capture-new-matching-index-patterns/194051>\
**Category:** Kibana\
**Created:** [August 6, 2019, 4:04pm UTC](https://discuss.elastic.co/t/how-to-update-alias-to-capture-new-matching-index-patterns/194051 "2019-08-06T16:04:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [August 6, 2019, 4:04pm UTC](https://discuss.elastic.co/t/how-to-update-alias-to-capture-new-matching-index-patterns/194051/1 "2019-08-06T16:04:21Z")

</div>

# TL;DR

How do I continuously update an alias to capture new matching index patterns?

# Longer Version...

We use a non-standard format that looks like this:

```
myapp-beatname-version-YYYY.mm.dd

```

I.e., a `heartbeat` index will look like:

```
myapp-heartbeat-7.2.0-2019.08.06

```

When using the Uptime module, the [heartbeat documentation](https://www.elastic.co/guide/en/uptime/current/install-heartbeat.html) notes that the Uptime module matches the index pattern `heartbeat-7*` and suggests using an alias if the index format doesn't match that. However, the alias documentation makes it clear that the following alias specification:

```
{
    "actions" : [
        { "add" : { "index" : "*-heartbeat-*", "alias" : "heartbeat-7.x.x" } }
    ]
}

```

However, the [index alias documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html) states that:

> In this case, the alias is a point-in-time alias that will group all current indices that match, it will not automatically update as new indices that match this pattern are added/removed.

Obviously, this does not work well with the Uptime module, where the alias must continuously update and capture newly-created aliases.

I'm certain there is a way around this, but I'm still enough of a novice in the ELK stack that I don't see it and haven't been able to find it in my searches.

---

<div class="post-metadata">

**Author:** ![christophilus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christophilus/32/42991_2.png) [@christophilus](https://discuss.elastic.co/u/christophilus)\
**Post date:** [August 6, 2019, 5:03pm UTC](https://discuss.elastic.co/t/how-to-update-alias-to-capture-new-matching-index-patterns/194051/2 "2019-08-06T17:03:01Z")

</div>

I've reached out to the Uptime team, so hopefully someone from there will weigh in. Looking at it, it does look as if there isn't a good solution. The only thing I can think of is to have some script that updates the alias whenever it detects a new index pattern. 😕 That's obviously not ideal. However, since your index patterns are day-based, you could run the script once a day, so it probably wouldn't be too complex or slow.

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [August 6, 2019, 5:50pm UTC](https://discuss.elastic.co/t/how-to-update-alias-to-capture-new-matching-index-patterns/194051/3 "2019-08-06T17:50:06Z")

</div>

Thanks.

As I read the [index alias documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html) further, it appears that it's possible to add an index assignment to the template, which means that it would automatically add itself to that alias when the daily index is created.

However, the question I have regarding this is then whether indices with a `heartbeat-7.x.x-YYYY.mm.dd` pattern would appear twice in Uptime - once from the original index, once from the `heartbeat-7.x.x` alias.

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [August 7, 2019, 1:35pm UTC](https://discuss.elastic.co/t/how-to-update-alias-to-capture-new-matching-index-patterns/194051/4 "2019-08-07T13:35:33Z")

</div>

My workaround for this was to add the following to the template:

```
"aliases": {
  "heartbeat-7.3.0-alias": {}
},

```

This has resolved the issue. I already use a script to upload templates to Elasticsearch. This script also edits the templates on the fly to add an additional index pattern match in order to apply it to our alternate index-name convention, so I should be able to update it to add the alias on the fly as well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 1:35pm UTC](https://discuss.elastic.co/t/how-to-update-alias-to-capture-new-matching-index-patterns/194051/5 "2019-09-04T13:35:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.