Index Alias for rotating time based indices

Elastic Stack Elasticsearch
1

Hi,

The docs here (https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html) are pretty explicit in that something like this:

POST /_aliases
{
    "actions" : [
        { "add" : { "index" : "test*", "alias" : "all_test_indices" } }
    ]
}

will not automatically update to include new indices that match.

If I'm using ILM or time based indices (filebeat, metricbeat) would I need to re-add this alias every time a new index is created, or is there a feature of ILM that would do this on my behalf? Right now I'm thinking the only way to do this would be a cronjob to update the alias on a schedule, or query for new indices and update when a new one is found.

Thanks,
Justin

2

If you are talking about rollover within an ILM policy, then the rollover action will update the alias automatically, you don't need to do that yourself.

3

Hi @dakrone,

To clarify, will it also update additional read only aliases, or just the write index ("is_write_index": true)?

For example, if I create the index like so, I'd want metrics-teamA and metrics-teamB to stay up to date when the index is eventually rolled to metrics-6.7.1-000002.

PUT metrics-6.7.1-000001
{
  "aliases": {
    "metrics-6.7.1": {
      "is_write_index": true
    },
    "metrics-teamA": {
      "filter": {
        "term": {
          "team": "A"
        }
      }
    },
    "metrics-teamB": {
      "filter": {
        "term": {
          "team": "B"
        }
      }
    }
  }
}

Thanks, Justin

5

For those reading this later on, if you include aliases on the index template, then they will be applied to future rollover indices as well as any indices created with the ilm shrink operation.

PUT _template/template_1
{
    "index_patterns" : ...
    "settings" : {
        ...
    },
    "aliases" : {
        "alias1" : {},
        "{index}-alias" : {} 
    }
}
1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.