# RESOLVED: Search Bug in 5.6.12 when searching with an Alias

**URL:** <https://discuss.elastic.co/t/resolved-search-bug-in-5-6-12-when-searching-with-an-alias/155034>\
**Category:** Kibana\
**Created:** [November 1, 2018, 2:44pm UTC](https://discuss.elastic.co/t/resolved-search-bug-in-5-6-12-when-searching-with-an-alias/155034 "2018-11-01T14:44:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tebriel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tebriel/32/44889_2.png) [@tebriel](https://discuss.elastic.co/u/tebriel)\
**Post date:** [November 1, 2018, 2:44pm UTC](https://discuss.elastic.co/t/resolved-search-bug-in-5-6-12-when-searching-with-an-alias/155034/1 "2018-11-01T14:44:05Z")

</div>

I'm running 5.6.12 (both Kibana and ES). I have an alias that points to 31 indices. In Kibana I have two index patterns.:

- `panorama-staging` -- an alias
- `*staging*-ivr-auth-master-*` -- the raw pattern used to create the alias

If i use the `_cat/aliases/panorama-staging` endpoint, and compare it with the `_cat/indices/*staging*-ivr-auth-master-*` endpoint, they both contain the same 31 indices.

If I enter the following search in the kibana search bar `container_name: debug-receiver` I get different results depending on the index pattern. If it's the alias, I get 0 results, no matter the time bucket. If it's the `*` pattern I get results as expected.

If I use the search API for either, I get expected results back (both return ~ the same number of hits, we're ingesting data, so variance is expected):

```auto
POST panorama-staging/_search
{
  "query": {
    "bool": {
      "must": {
        "query_string": {
          "query": "container_name: debug-receiver"
        }
      }
    }
  },
  "size": 10
}

POST *staging*-ivr-auth-master-*/_search
{
  "query": {
    "bool": {
      "must": {
        "query_string": {
          "query": "container_name: debug-receiver"
        }
      }
    }
  },
  "size": 10
}

```

---

<div class="post-metadata">

**Author:** ![tebriel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tebriel/32/44889_2.png) [@tebriel](https://discuss.elastic.co/u/tebriel)\
**Post date:** [November 1, 2018, 2:51pm UTC](https://discuss.elastic.co/t/resolved-search-bug-in-5-6-12-when-searching-with-an-alias/155034/2 "2018-11-01T14:51:44Z")

</div>

The aliases are created by the index template, as seen here:

```auto
  "ivr-auth-staging": {
    "order": 100,
    "template": "*staging*-ivr-auth-master-*",
    "settings": {
    },
    "mappings": {},
    "aliases": {
      "panorama-staging": {}
    }
  }

```

---

<div class="post-metadata">

**Author:** ![tebriel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tebriel/32/44889_2.png) [@tebriel](https://discuss.elastic.co/u/tebriel)\
**Post date:** [November 1, 2018, 2:59pm UTC](https://discuss.elastic.co/t/resolved-search-bug-in-5-6-12-when-searching-with-an-alias/155034/3 "2018-11-01T14:59:04Z")

</div>

Okay! I figured it out. Typing out all this information helped me narrow it down. I went into the Chrome Debug tools, grabbed the network request for the search, and this helped narrow it down. My search using the alias instead of the pattern was the following, which fails under the index and the pattern. Running this query yielded 0 results. It's because I set up the pattern with `timestamp` as the time field instead of `@timestamp` (we have some duplicated fields due to the breadth of micro-services logging).

```auto
{
  "version": true,
  "size": 500,
  "sort": [
    {
      "_score": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "analyze_wildcard": true,
            "query": "container_name: debug-receiver"
          }
        },
        {
          "range": {
            "timestamp": {
              "gte": 1541083029539,
              "lte": 1541083929539,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "must_not": []
    }
  },
  "_source": {
    "excludes": []
  },
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "timestamp",
        "interval": "30s",
        "time_zone": "America/New_York",
        "min_doc_count": 1
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    "@timestamp",
    "headers.created_utc",
    "start_utc",
    "t",
    "timestamp",
    "timestampUtc",
    "ts"
  ],
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {
        "highlight_query": {
          "bool": {
            "must": [
              {
                "query_string": {
                  "analyze_wildcard": true,
                  "query": "container_name: debug-receiver",
                  "all_fields": true
                }
              },
              {
                "range": {
                  "timestamp": {
                    "gte": 1541083029539,
                    "lte": 1541083929539,
                    "format": "epoch_millis"
                  }
                }
              }
            ],
            "must_not": []
          }
        }
      }
    },
    "fragment_size": 2147483647
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 29, 2018, 2:59pm UTC](https://discuss.elastic.co/t/resolved-search-bug-in-5-6-12-when-searching-with-an-alias/155034/4 "2018-11-29T14:59:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.