Index Alias and Index operation

Elastic Stack Elasticsearch
1

I have to create an index alias representing two indexes, but index the content to one of the indexes based on a value. The case is as below:

Let us assume I have indexes 20160314_16 and 20160317_20 representing a weeks data. I need to have an alias which says WeekOf20160314, which represents both the index.

Now when I put a indexing request using alias, based on the attribute contentdate, the data should be indexed into appropriate index. Is it possible?

2

Not sure what the requirement is but , in my scenario I am creating an index on daily basis based on content date and creating dashboard on all the indexes based on a common alias . I guess this is exactly you are looking for , if this is the case then it is possible .

3

We are not creating daily indexes as it will be 380+ at any given time in my cluster. We need to keep 15 months of data (hot and queriable). Thought of creating weekly indexes and split the index (by reindex as operation activity) when the size of shard goes above 50 GB....

4

You can index through an alias, but only if there are no conflicts.
If you index to an alias like this then the event will go to both/all indices.

5

Thanks mark. We thought of controlling using metadata, but wanted to validate if we have some template based capability. It might be a good idea to add this capability to add this feature in ES upcoming versions...viz. Define which index the new content should go to based on a condition...

6

We recommend writing to a specific index instead of an alias to prevent this.