I went through the following blog post
and used the same calls to create indices, add data and rollover indices
after executing rollover indices it created another new index as max_docs condition was hit.
And active-logs alias now points to the new index active-logs-2 index whereas search-logs alias points to both active-logs-1 and active-logs-2 indices.
How did it determine one alias was used for indexing and the other one for searching? I didnt specify any parameters indicating about search or index.