# Time based Index pattern expansion with aliases

**URL:** <https://discuss.elastic.co/t/time-based-index-pattern-expansion-with-aliases/78133>\
**Category:** Kibana\
**Created:** [March 10, 2017, 10:57am UTC](https://discuss.elastic.co/t/time-based-index-pattern-expansion-with-aliases/78133 "2017-03-10T10:57:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tktr](https://avatars.discourse-cdn.com/v4/letter/t/eb8c5e/32.png) [@tktr](https://discuss.elastic.co/u/tktr)\
**Post date:** [March 10, 2017, 10:57am UTC](https://discuss.elastic.co/t/time-based-index-pattern-expansion-with-aliases/78133/1 "2017-03-10T10:57:49Z")

</div>

I'm currently experiencing an issue with Kibana using time based index patterns with aliases. Basically, I have time based indices which are rotated daily in the form **foo-YYYY.MM.DD**. Each index uses filtered aliases **bar** and **baz** :

```
"aliases" : {
  "foo" : {
    "filter" : {
      "term" : {
        "attribute" : "foo"
      }
    }
  },
  "bar" : {
    "filter" : {
      "term" : {
        "attribute" : "bar"
      }
    }
  }
}

```

When using the index patterns **bar** and **baz** , queries using these patterns are always executed against all indices having the corresponding aliases which is a bit problematic in terms of performance.

For this reason, I tried to use a time based alias form for each index (corresponding date patterns are set for each day):

```
"aliases" : {
  "foo-YYYY.MM.DD" : {
    "filter" : {
      "term" : {
        "attribute" : "foo"
      }
    }
  },
  "bar-YYYY.MM.DD" : {
    "filter" : {
      "term" : {
        "attribute" : "bar"
      }
    }
  }
}

```

Using the index patterns **bar-\*** and **baz-\*** , all queries are executed against the indices **foo-YYYY.MM.DD** and not **bar-YYYY.MM.DD** and **baz-YYYY.MM.DD** as I would expect it. Hence, queries return all documents and not the ones with the attributes that should be filtered.

The only solution which I came up with until now is to use the latter alias form with the deprecated index pattern **[bar]-YYYY.MM.DD**.  
Is there any other proper solution to achieve this without getting a performance penalty?

* * *

**Elasticsearch: 5.2.2**  
**Kibana: 5.2.2**

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [March 10, 2017, 7:44pm UTC](https://discuss.elastic.co/t/time-based-index-pattern-expansion-with-aliases/78133/2 "2017-03-10T19:44:57Z")

</div>

This is something of a known issue, and it's caused by Kibana's caching of index mappings, and the use of a field\_stats API in elasticsearch to "expand" an index pattern at query time. The short of it is, aliases aren't returned from the field\_stats API, the underlying indices are, so those are used directly, the alias is not used, and so neither is the filter.

The easiest solution is to check _Do not expand index pattern when searching (Not recommended)_ box when setting up the index pattern. This will prevent the index pattern "expansion" and just use the star pattern directly. There is a description of what this means in the interface, and I encourage you to read it before you just start using that as there are some trade-offs. But by checking that, it will use the alias directly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 7, 2017, 7:45pm UTC](https://discuss.elastic.co/t/time-based-index-pattern-expansion-with-aliases/78133/3 "2017-04-07T19:45:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.