Search returns nothing when use alias,When changing to original index can get data

[simmonHuong]

suppose I have a two alias index,created by the template alias.

a_wm_201901 alias to wm_201901
b_wm_201901 alias to wm_201901

##returns nothing when query like below
{"index":"a_wm_201901","type":"doc","body":{"sort":[{"id":{"order":"desc"}}],"from":0,"size":25,"_source":["*"]},"ignore_unavailable":true} 


##returns the correct documents
{"index":"wm_201901","type":"doc","body":{"sort":[{"id":{"order":"desc"}}],"from":0,"size":25,"_source":["*"]},"ignore_unavailable":true} 

Enviroment:

docker-elk,with the both latest version(6.5.4) elk.
Only one node elasticsearch,each index have 3 primary shard,no replicate.

Can anybody tell why this happen? Is there something I forget or made a mistake?

[spinscale (Alexander Reelsen)]

are you using security features? If so, maybe you are only allowed to read that index.

If you are not, we would greatly appreciate a full reproduction, starting with index/alias creation, document indexing and then the full queries.

Thanks!

--Alex

[simmonHuong]

The truth is I was using template index,It's all because of the filter term,I should specify it keyword

The conclusion is when you use template index do make sure your filter works.

  "aliases": {
      "a_{index}" : {
            "filter" : {
                "term" : {"company" : "a" }/* if the company is not specified as keyword,here you should use company.keyword instead */
            }
      },
      "b_{index}" : {
            "filter" : {
                "term" : {"company" : "b" }
            }
      }
  }