Index/alias Filter(s)

[Talvaro (Alvaro Fernandez)]

I'm researching an issue with a existing application I just got as responsible. I am not too familiar with Elastic/Kibana. The issue is the application reading docs from an Alias is not getting all expected results. I noticed by executing a "GET _cat/aliases/?v=true&s=alias,index" that the alias or perhaps the indexes grouped by the alias have "filters" (an asterisk in next to the Index name - under column "filter". My question is: how can I visualize what is the filter setting (what has been filtered out form the index/alias). ANy help will be greatly appreciated!!!!!

[Wave (Andrew Sullivan)]

Hi Talvaro,
You might have already found this documentation about alias filters, but if not it could be helpful. I believe the "asterisk" means that a filter is present. So you'll need to do an additional query to see exactly what the filter is doing. Try (after replacing your_alias_name_here with the alias in question):

GET _alias/your_alias_name_here

That should probably give a better idea of what is being filtered.

[Talvaro (Alvaro Fernandez)]

Yes, @Wave , I just found out. The filter is defined as:
"filter" : {
"range" : {
"payloadAttributes.processTimeStamp" : {
"gte" : "now-30d/d",
"lte" : "now/d"
}

Now the question is: how to modify it? I would like to eliminate the "lte" since I think this is letting most recent Docs out of the intentioned request.

THANKS!!!!!

[Wave (Andrew Sullivan)]

You're welcome. You should be able to change the filter by including it in the add section. Just keep the same index names and alias name and you should be good to go. I'd recommend saving a copy of the output of the alias before making changes if you haven't already.