Update Aliases API

[Oscar_Lopez]

I have an index_pattern called metricbeat- * which I create an alias called alias_metricbeat. Through the elasticsearch API I want to condition so that certain users do not perform filters of more than three months in the boards, someone can tell me how I can do it, thank you.

My template is:

PUT _template/demoalias
{
"index_patterns" : [
"matricbeat-*"
],
"aliases": {
"alias_metricbeat": {}
},
"mappings": {},
"settings" : {
"index" : {
"codec" : "best_compression",
"refresh_interval" : "5s",
"number_of_shards": "5",
"number_of_replicas": "1",
"lifecycle.name": "lifecycle_metricbeat",
"lifecycle.rollover_alias": "lifecycle_metricbeat_rollover"
}
}
}

[warkolm (Mark Walkom)]

Checkout Update index alias API | Elasticsearch Reference [7.11] | Elastic

[Oscar_Lopez]

Cordial greetings Warkolm, in the url I see that there are some examples in my case if I want to condition several users or a specific test role, how can the query go. Thanks.

POST /_aliases
{
"actions": [
{
"add": {
"index": "metricbeat-*",
"alias": "alias_metricbeat",
"filter": { "term": { "?": "test" } }
}
}
]
}

[warkolm (Mark Walkom)]

I'm not sure what you mean there sorry.

[Oscar_Lopez]

Good morning Warkolm, The situation is that some users are performing very extensive time filters in the kibana boards and I want to restrict some users so that at the time of filtering they can only place the date range of the last three months of an index pattern is this possible with aliases?

[warkolm (Mark Walkom)]

Yes, it is with a filtered alias.