17

I recently started working in a company that uses Elasticsearch. While most of its concepts are somewhat similar to relational databases and I am able to understand them, I still don't quite get the concept of aliases.

I did not find any such question here and the information provided on the Elasticsearch website did not help much either.

Can someone explain what aliases are for and ideally include an example of a situation where they are needed?

Jan Pisl
  • 1,043
  • 2
  • 14
  • 29

3 Answers3

18

aliases are like soft links or shortcuts to actual indexes

the advantage is to be able to have an alias pointing to index1a while building or re-indexing on index2b and the moment of swapping them is atomic thanks to the alias, to which all code should point

Renaming an alias is a simple remove then add operation within the same API. This operation is atomic, no need to worry about a short period of time where the alias does not point to an index:

[EDIT] as pointed out @wholevinski aliases have other functionalities like:

Multiple indices can be specified for an action ...

all the info is in the page you have linked

[EDIT2] more on why the need/benefit of the atomicity

the key being "zero downtime" https://en.wikipedia.org/wiki/Zero_unscheduled_downtime or https://en.wikipedia.org/wiki/High_availability

https://www.elastic.co/guide/en/elasticsearch/guide/current/index-aliases.html

We will talk more about the other uses for aliases later in the book. For now we will explain how to use them to switch from an old index to a new index with zero downtime.

arhak
  • 2,488
  • 1
  • 24
  • 38
  • 1
    I like this use case better than the one I had in mind. It's worth noting that you can also use an alias to combine multiple indexes under one alias. – wholevinski Feb 21 '18 at 13:25
  • Thank you but I still don't feel like I understand it very well. Could you perhaps explain it in a more "ELI5 way"? – Jan Pisl Feb 21 '18 at 13:35
16

@arhak covered the topic pretty well. One use case that (at least) made me understand the value of indices was the need to remove out-of-date documents and more specifically when using time-based-indices.

For example, you need to keep the logs of an application for at least one year. You decide to use time-based-indices, meaning you save into indices with the following format: 2018-02-logs, 2018-03-logs etc.. In order to be able to search in every index you create the following alias:

POST /_aliases
{
 "actions": [{ 
     "add": {
          "alias": "current-logs", "indices": [ "2018-02-logs","2018-03-logs" ]
        }  
  }]
}

And query like:

GET /current-logs/_search

Another advantage is that you can delete the out-of-date values very easily:

POST /_aliases
{
  "actions": [

      { "remove": { "alias": "current-logs",  "index": "logs_2018-01" }}
  ]
}

and DELETE /logs_2018-01

Eirini Graonidou
  • 1,506
  • 16
  • 24
  • this is interesting concept, but if feel like "aliases" are sort of temporary helpers and not a static things that will be always used in Elasticsearch. Because in your example, what I'd like to have it to use "current-logs" for latest two month indices. But from an example, as soon as 2018-04 will come this alias will be outdated. I hope I explained my question correctly – Yevhenii Herasymchuk Jun 20 '20 at 17:52
2

Aliases are basically created to group a set of indices and make them accessible regarless the name they have. Is a pointer to a set of indices. You can also apply a query/condition to all of these indices. It is very useful when performing queries or creating dashboards over the same group of indices all the time. In addition, if in the future you change the name of the indices that are part of an alias, the end users will not notice that change since it is for transparent for them and you will only update the pointer.

sgalinma
  • 202
  • 1
  • 5