Pointing index name to alias



I would like to point alias name in indexing to update a document in multiple daily indices using logstash with the id of the document. But when i provide the alias name it throws error and when i give index name with wildcard (*) character no error but the document is not indexed.

Is there any solution to update documents with additional field in multiple indices by passing the id of the document?

(Junaid) #2

What is the exact error that you getting? Can you provide more details?

(David Pilato) #3

You can run update by query on multiple indices but you can't run update document api on multiple indices.



How to use update by query in logstash ? I could able to find only update api for logstash.

Should I use http output plugin?


Illegal argument exception: alias has more than 1 indice associated with it.

(David Pilato) #6

I guess so.
Is that a frequent operation actually? I thought it was a one time operation.


Yes it is a frequent update on daily basis for old records

(Junaid) #8

@Chelambarasan_CR Can you share output of _aliases for your index. I believe you have a single alias connected to multiple physical indices.


output {
stdout {
codec => rubydebug
elasticsearch {

	hosts => ["localhost:9200"] 

	index => "alias1"
	document_type => "data"
	action => "update"
	document_id => "1"


(Junaid) #10

Can you share the output from below mentioned endpoint?

curl -XGET localhost:9200/_aliases?pretty


".kibana": {
"aliases": {}

"test2": {
"aliases": {
"aliastest": {}
"test1": {
"aliases": {
"aliastest": {}

aliastest is the alias name


output {
stdout {
codec => rubydebug
http {

	url => "http:localhost:9200/test1/_update_by_query?q=id:1"
	http_method => "post"
	format => "json"


Tried this but getting error"Could not able to fetch the url."

Just want to confirm whether the http url for update by query is right?

(David Pilato) #13

Please format your code, logs or configuration files using </> icon as explained in this guide and not the citation button. It will make your post more readable.

Or use markdown style like:


This is the icon to use if you are not using markdown format:

There's a live preview panel for exactly this reasons.

Here the URL seems wrong to me. It should be something like:

url => "http://localhost:9200/test1/_update_by_query?q=id:1"


url => "localhost:9200/test1/_update_by_query?q=id:1"


Getting this error on removing http`

[HTTP Output Failure] Could not fetch URL {:url=>"localhost:9200/test1/_update_by_query?q=_id:1",

"URI does not specify a valid host name: localhost:9200/test1/_update_by_query?q=_id:1", :class=>"Manticore::ClientProtocolException", :backtrace=>nil,`

(David Pilato) #15

What about:

url => "http://localhost:9200/test1/_update_by_query?q=id:1"


[2019-03-08T16:17:34,642][ERROR][logstash.outputs.http    ] [HTTP Output Failure] Encountered non-2xx HTTP code 400 {:response_code=>400, :url=>"http://localhos
, :will_retry=>false}by_query?q=_id:1", :event=>2019-03-08T10:47:33.712Z CHNMCT123553L 1,samplexml

(David Pilato) #17

The response is not complete.

Anyway, I'd recommend asking this in #logstash forum instead.


ok. opening a thread in logstash

(system) closed #19

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.