ElasticSearch Filtered aliases with multiple terms

Question

I was refering to the document https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html#filtered According to this we can have a filtered alias as follows

POST /_aliases
{
    "actions" : [
        {
            "add" : {
                 "index" : "test1",
                 "alias" : "alias2",
                 "filter" : { "term" : { "user" : "kimchy" } }
            }
        }
    ]
}

I have a requirement where in I want to use alias to group documents of multiple users, will it be a good idea if we create alias with multiple filter terms as follows .

POST /_aliases
{
    "actions" : [
        {
            "add" : {
                 "index" : "test1",
                 "alias" : "alias2",
                 "filter" : { "terms" : { "user" : ["kimchy","testuser1","testuser2" ]} }
            }
        }
    ]
}

Also can I use the operations like count,delete_by_query,update_by_query on such aliases ? Are there any limitations for such aliases
Regards,

Answer 1

If your alias points to multiple indices, you can only perform writes(insert, update) on only one specific index which you need to explicitly mention while creating an alias as shown below.

POST /_aliases
{  
   "actions":[  
      {  
         "add":{  
            "index": "mysampleindex",
            "alias": "myalias",
            "is_write_index": true
         }
      },
      {  
         "add":{  
            "index": "myothersampleindex",
            "alias": "myalias"
         }
      }
   ]
}

According to this LINK,

Only one index per alias can be assigned to be the write index at a time. If no write index is specified and there are multiple indices referenced by an alias, then writes will not be allowed.

Also can I use the operations like count, delete_by_query, update_by_query on such aliases?

• count - Yes

• delete_by_query

  • Yes but unlike the writes, the is_write_index doesn't apply to deletion which means the query POST myalias/_delete_by_query { "query": { "match_all": {} }} would end up deleting all data from all indices even if the above stated property is mentioned.
  • The better way to ensure you don't accidentally delete across all the indexes pointed by alias, is not to use alias.

• update_by_query - Already mentioned above.

I have a requirement where in I want to use alias to group documents of multiple users, will it be a good idea if we create alias with multiple filter terms as follows?

Well for limitations, you can refer to this SOF link

As for good idea, to be honest, it depends on levels of abstraction as how you intend to add an abstraction layer for your application. Design is a broad topic and it depends on many factors as how you intend to have your alias created as opposed to adding filters in query. One important thing to note is that if you are exposing your index to the external consumers and want to restrict them or ensure they don't get unwanted results, then certainly it would make sense.

I can think of below use-case where I think alias using filtered query would make sense.

• Main Index - globalindex
• Alias - asia-pacific, europe, americas, africa

And your globalindex would have a field called "region": "asia-pacific" which you can use to create filter alias. But then again, I'm not saying this is optimum solution. I can instead create multiple indexes as well.

Hope it helps!