# Writing to wrong index **URL:** \ **Category:** Elasticsearch\ **Created:** [September 7, 2018, 7:44pm UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761 "2018-09-07T19:44:26Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![waynesmallman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waynesmallman/32/18596_2.png) [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Post date:** [September 7, 2018, 7:44pm UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/1 "2018-09-07T19:44:26Z")
I need to update a mapping with additional fields, but decided to create an experimental map first and write documents to it to weed out the problems. As it happened, the whole thing worked first time of asking, but then the next document didn't. When I checked, the document was in the original: "bookmarks\_en\_v1" and not: "bookmarks\_en\_v1-1". Kibana also refused to allow me to add the index pattern: "bookmarks\_en\_v1-1" after removing it, in spite of the fact that it was there (I've checked in Postman). So I deleted the experiment, renamed it to: "bookmarks\_en\_v1\_1" and started again, where this time three documents were written before it again switched to the original, and — as before — refused to write to the experiment again. Again, I changed the index name, this time to: "experiment", and the type to: "experiment", where it wrote once and then no more, writing — again — to the original. There is no mention of the original index: "bookmarks\_en\_v1" anywhere in the application (I've used the built-in search services in the IDE, and besides, I'm passing the index names as variables). It's worth noting this is a mature application that's been using Elastic without error since 5.6. This behaviour is inexplicable, and — according to the code — impossible, too. I'm using Elastic 6.2.4, and Kibana of the same version. ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [September 9, 2018, 6:02pm UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/2 "2018-09-09T18:02:45Z")
So basically you are writing one or a few documents to the intended index and then they get written to another one? That is ... unexpected. The first thing I could think about are aliases. Are you doing anything funky with them and your application might add / change them dynamically? `GET /_cat/aliases?v` should give you the relevant information. ---
**Author:** ![waynesmallman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waynesmallman/32/18596_2.png) [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Post date:** [September 10, 2018, 7:49am UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/3 "2018-09-10T07:49:56Z")
Hi! Yes, after spending some time on this, that appears to be what's happening. When I run the URL you gave me, I got: `alias index filter routing.index routing.search` ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [September 10, 2018, 8:15am UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/4 "2018-09-10T08:15:38Z")
Hm, that's an [empty list of aliases](https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-alias.html) — you're only seeing the header line (coming from the `?v` in the call). I'm a bit out of ideas why this might be happening. ---
**Author:** ![waynesmallman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waynesmallman/32/18596_2.png) [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Post date:** [September 10, 2018, 8:53am UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/5 "2018-09-10T08:53:53Z")
Hi, you've already given me something else to look at, to help diagnose the problem. It's possible I deleted those aliases last night (I was doing a _lot_ of experimentation), or perhaps (and you would know better), this problem stems from an upgrade from 5 to 6? I'm in the middle of a minor crisis at the moment, so response time are bound to be a bit hit and miss. ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [September 10, 2018, 10:01am UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/6 "2018-09-10T10:01:15Z")
It is possible that you deleted the aliases , but it's hard to tell. I'm not even fully convinced that your problem stems from aliases. I doubt it's from an upgrade. You might run into errors or deprecation notices, but nothing would automatically switch your indices. To be blunt, I've never seen a problem like this before and I'm suspecting your application to do something unexpected. Though I have no idea what in particular and if it's an alias or something else. ---
**Author:** ![waynesmallman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waynesmallman/32/18596_2.png) [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Post date:** [September 10, 2018, 10:35am UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/7 "2018-09-10T10:35:57Z")
I've checked with production and got: ``` alias index filter routing.index routing.search notes notes_en_v1 - - - folders folders_en_v1 - - - comments comments_en_v1 - - - bookmarks bookmarks_en_v1 - - - messages messages_en_v1 - - - ``` ... and that is correct, so I did delete everything on development. But is it possible that documents are getting written to an alias as if it was an index? I ran the command: `GET localhost:9000/_mapping?pretty` and didn't find "bookmarks". ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [September 10, 2018, 11:18am UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/8 "2018-09-10T11:18:00Z")
Yes, if an alias points to a single index you can write to it. If an alias points to multiple indices then it's read-only. ---
**Author:** ![waynesmallman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waynesmallman/32/18596_2.png) [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Post date:** [September 10, 2018, 12:35pm UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/9 "2018-09-10T12:35:03Z")
I need to do more testing tonight, but I do appreciate the information, which — I'm sure — I'll put to good use. ---
**Author:** ![waynesmallman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waynesmallman/32/18596_2.png) [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Post date:** [September 10, 2018, 9:08pm UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/10 "2018-09-10T21:08:00Z")
I've had a chance to look at the mapping, and the results are: "folders", "notes", "bookmarks", and "comments" which _were_ aliases, not indexes, but — as noted — there are no aliases. This appears to have happened as a result of the upgrade to 6.3 from 5.3 that happened in the background on the Mac, which is miraculous given how much of a pain it was to do on staging and then development. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 8, 2018, 9:08pm UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761/11 "2018-10-08T21:08:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.