I'm afraid this is not possible with aliases. Aliases have functionality to filter the query, but this is just an inclusion / exclusion filter. For example, alias1
could be a filtered alias that only allows the search query to see user1
documents.
Aliases do not have any capability to actually modify or manipulate data.
There are some options, but they all have trade-offs.
Script Fields
You can use Script Fields to provide a "virtual" field. Essentially, you run a script which loads some field, then performs whatever manipulation you need (e.g. 4444-444-777
-> xxxx-xxx-777
). This is then returned to you as an extra field in the search results. The caveat is that the original data is still visible in the original _source
, so your app will need to make sure that isn't exposed.
Transform
If you don't ever want the original data to be returned, you can perform a Transform which will physically alter the _source
document before it is indexed. This means that the data you get back from the search results will be pre-manipulated...but you will never be able to access the original data (because it has been transformed).
Your application code
It may be best to just perform this filtering in your application code. Simpler, easier to change, not doing anything fundamentally different from what ES would have to do anyway.