Question regarding rollover indices aliasing

Elastic Stack Elasticsearch
1

Hi,

I went through the following blog post

and used the same calls to create indices, add data and rollover indices

after executing rollover indices it created another new index as max_docs condition was hit.

And active-logs alias now points to the new index active-logs-2 index whereas search-logs alias points to both active-logs-1 and active-logs-2 indices.

How did it determine one alias was used for indexing and the other one for searching? I didnt specify any parameters indicating about search or index.

Thanks

2

The first json post in that blog post has;

"aliases": {
    "active-logs":  {},
    "search-logs": {}
  }

That's where it's established.

3

so, by default the first alias is assumed to be used for indexing and the second one for searching?

4

No, that's just an example of assigning multiple aliases.

5

after rollover was done I executed the following end point

GET http://localhost:9200/_cat/aliases?v
and the output was

why is "active-logs" alias pointing to only "active-logs-000002" whereas "search-logs" alias is pointing to both "active-logs-1" and "active-logs-000002"?

how did it determine "active-logs" alias was used for indexing? I did not specify that "active-logs" alias is used for indexing and "search-logs" is used for searching in the above list of calls.

6

Did you run the last POST command in the blog that updates the aliases?

It doesn't. These are simply abstractions to make it easier.

Rather than the system that sends the logs to ES having to know that the current active index is active-logs-000001 and then after the rollover is now called active-logs-000002, you use these as abstractions to that all it needs to do is write to active-logs.

7

Did you run the last POST command in the blog that updates the aliases?

did you mean this code? then no, I didn't. POST active-logs/_rollover is the last command I ran.

POST _aliases
{
  "actions": [
    {
      "remove": {
        "index": "active-logs-1",
        "alias": "search-logs"
      }
    },
    {
      "add": {
        "index": "inactive-logs-1",
        "alias": "search-logs"
      }
    }
  ]
}
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.