Posting document to alias instead of index

I'm not quite sure why this isn't working but I'm trying to post to an alias instead of an index and it's not working. I have indexes called
index-september & index-october and they are both under the alias index. When I put my logstash index => "index" it fails but when I put index => "index-september" it succeeds. Can I post to an alias?

I'm doing post processing on data in my indices and I'd like the documents to reroute via their _id to the correct index. I'm pulling them in via the elasticsearch input plugin. Any suggestion on how to do this?

Thanks!

I think you have to set is_write_alias: true on one index referenced by the alias for writing, even if there is only one.

Will it automatically send events that get pulled in from index-september to index-september when I input and output to elasticsearch via an alias?

If you had indices index-january thru index-september (the is_write_alias: true). Read via the alias "index" would read from all of them, just like using a wildcard "index-*". Writes to "index" would go to index-september. I think if you post directly to any, (index-june) you could write to them (unless set to read only).

The idea of rollover is at 01/01/2019 00:00:00 you create index-october and set is_write_alias: true, writes to "index" go to the new month. (I don't think the rollover api or ILM can do rollover at a specific time however, they do it by size, age or # events.)

Hmm okay thanks for your help! I think I'll pull the metadata _index and see if I can post to it's index like that! :smiley:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.