Rollover Failing

Elastic Stack Elasticsearch
1

Getting a failure - Rollover API complains that I have multiple aliases in my template but I created only one in the template. If i DONT use templates, the rollover works absolutely fine.

----- This is my current elastic stack content. -----

Index : my-index-2018.09.01-1
Alias : my-index

----- Error: -----
Rollover alias [my-index] can point to multiple indices, found duplicated alias [[my-index]] in index template [mytemplate]

----- Template: -----

{
    "mytemplate": {
        "order": 0,
        "index_patterns": [
            "my-index-*"
        ],
        "settings": {},
        "mappings": {
            "_doc": {
                "properties": {
                    "@timestamp": {
                        "type": "date"
                    }
                }
            }
        },
        "aliases": {
            "my-index": {}
        }
    }
}
2

You should not be assigning the rollover alias name in a template. It only needs to be assigned once, at creation time of the original rollover index.

After that, the alias is automatically re-pointed when performing rollovers. You can assign a different alias in the template, but not re-assign the rollover alias.

1 Like
3

Thank you for the quick reply.
I forgot to add - our INTENT is to have my-index alias to point to the old and the new rolled over index. I see what you are saying - dont add my-index as an alias during template creation time. But IF i don't do this - after rollover, my-index will point to the new index but the old index will be left without an alias and wont be searchable like /my-index/_search - which will return only the new index values

4

The solution is to not use the rollover alias, but a different alias name.

Create an alias called "search-all" (for example), and use that in the template. Add the current indices to the "search-all" as well. Search with /search-all/_search then, and it will point to all of your indices.

The rollover alias name should only ever be used in conjunction with the rollover API in your case to simplify things.

5

It may help to be even more name specific with the aliases, e.g. index data to the rollover-alias, and search data from the search-alias. Whatever makes sense to you.

You have to understand, though, that you can't even ship data to an alias that points to more than one index. An alias that points to one and only one index can be used to read and write data. An alias that points to more than one index is read-only.

6

I see. So based on the above approach - I can add the search alias as part of the template but the add the rollover alias manually AFTER the index is first created?

7

If the rollover index is already created, then yes, you'd have to assign the rollover alias manually. Otherwise, creating an index and immediately assigning its rollover alias is as simple as:

PUT /indexname-000001 
{
  "aliases": {
    "rollover_alias_name": {}
  }
}
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.