1

Lets take the following scenario.

I have an alias A1 pointing to index I1. Now, I would like to use rollOver feature of ES and create index I2 and make alias point to I1 and I2.

Can I always keep rolling over and make my alias A1 point to last 2 indices or in general last 'n' indices ?

Anirudh Kashyap
  • 297
  • 1
  • 5
  • 16
  • It can be achieved with simple `index-templates` right!. Let's say you have 2 aliases A1 and A2 where A1 points to latest index and other points to all `I*` indices. This way `A2` always points to multiple indices as you expected. What ever you are expecting to do with `A1`(if it points to multiple indices), you can achieve the same with `A2` also. Hope you understand this thin distinction. Let us know if you think otherwise. – avr May 15 '17 at 21:39

1 Answers1

1

You can point one alias to multiple indices like this:

POST /_aliases
{
    "actions" : [
        { "add" : { "indices" : ["l1", "l2"], "alias" : "A1" } }
    ]
}

or even point the alias to a wildcard index pattern like this:

POST /_aliases
{
    "actions" : [
        { "add" : { "index" : "l*", "alias" : "A1" } }
    ]
}

EDIT: With rollover, you can only point the alias to one index - the latest index. If you want an alias that points to the last 2 indices, n indices, or all of the indices matching the pattern l*, you'll have to create an additional alias using the requests I showed above.

EDIT 2: If I wanted to maintain 30 days of logs in an index, this is how I would accomplish it. I stayed consistent with the naming of indices as 'l1' and alias of 'A1'. After the first 30 days, a new index will be created called l000002 (the naming convention is incrementing the number of the last index and zero padding with a length of 6) and the alias A1 will be pointing at the index l000002. I would create a second alias to refer to 'l*' like you originally desired.

PUT /l1
{ "aliases": { "A1": {} } }


POST /A1/_rollover  
{ "conditions": { "max_age": "30d" } }

POST /_aliases
{
    "actions" : [
        { "add" : { "index" : "l*", "alias" : "A2" } }
    ]
}
fylie
  • 1,675
  • 1
  • 10
  • 14
  • I am referring to this in case of rollOver index feature. I know I can do this separately. – Anirudh Kashyap May 15 '17 at 17:49
  • But my question was, why can't RollOver feature do that ? Is there a specific reason ES is not doing it ? – Anirudh Kashyap May 15 '17 at 18:38
  • The purpose of rollover is to reference the most up-to-date data, which is why the alias managed by rollover only points to one index (the latest). – fylie May 15 '17 at 18:44
  • Lets say you always to maintain last 30 days of data in your indices ? How do you do it with RollOver ? – Anirudh Kashyap May 15 '17 at 18:53
  • You created an another index A2 pointing to 'I*' and this has to be managed separately. I was looking for a feature from ES which would always maintain the last 30 days of logs and it would be like a sliding window behavior and not like a jumping window. – Anirudh Kashyap May 16 '17 at 18:35
  • There is no built in functionality for a sliding window - you should have to maintain the aliases manually. – fylie May 17 '17 at 02:57
  • is alias something like tag?? @fylie – AATHITH RAJENDRAN Sep 12 '19 at 03:52