Update items in a rolled-over index

Elastic Stack Elasticsearch
#1

Hi there! A quick and simple question related to rolled-over indexes.

Is it a good approach to have a rollover index if, eventually, we want to update items that belong to an already completed index (rolled-over)?

As far as I can see, you can update an item with a given existing ID (within a rolled-over index), but in that case, a new item will be created in the current "writing" index, ending up in having 2 items with the same ID in two different indexes (one rolled-over, one active).

Thanks!

1 Like
#2

I don't think that you write a new document, only if you are indexing something new, if you are only using the update APIs, there's no duplicity at all, even by the index alias you could update the document without any trouble.

#3

That is only correct as long as the document being updated is in the index currently being written to. If you try to update a document in a previously rolled over index you can not do so through the write alias but need to go directly to the correct index.

#4

Is that expected for 'update by query' with backing index for Data Streams as well?, cause I was under the impression that it never happen in the Data Streams Scenario. @Jorge_Ruiz Could you specify if you are using indexes or data streams?.

#5

Update-by-query works against all indices but can be quite expensive. Updates based on ID requires index to be specified.

#6

I'm using indexes, not data streams. So, from your answer @Christian_Dahlqvist I guess I could update an element inside an index that has been already rolled-over, using the index name instead of the alias.

Thanks

#7

Ok, I did that and worked (I mean, update an element that is in a rolled-over index using the index name).

The question is, does it makes sense? Because I thought, the idea is that the rollover only points to one writing index, the others are not for writing... anyway, seems that they are.

The property is_write_index for all the indexes is false except for one (the active one), which is true. Why I am able to write in other indices? In other words, is correct to think in a rolled-over index to be changed eventually?

Thanks again