5

Our new rollover indices just rolled over. Now this query...

GET http://my.elastic/system-logs/_doc/7e8017d8-0cb8-4b9e-b021-b2a4b4ac71c7

...fails with this:

"Alias [system-logs] has more than one indices associated with it [[system-logs-000002, system-logs-000001]], can't execute a single index op"

But doing the same thing with _search works fine:

GET http://my.elastic/system-logs/_search/
{
    "query": {
        "bool": {
            "must": [{"term": {"_id": "a1906f52-3957-4f4b-9b40-531422e3a04e"}}]
            }
        }
}

The exception comes from this code, which looks like there is an allowAliasesToMultipleIndices setting for this, but I haven't been able to find a place to set it.

We're on Elastic 6.8.

Lars P
  • 796
  • 6
  • 16

1 Answers1

5

In the first http request, you are just trying to find the doc with particular id on an index which in turn is an alias of more than one index.

That's the problem.

Reason:

_doc is a mapping type in elastic search. It is used to segregate documents in the same index. So it cannot check across the indices. It is deprecated. Refer, this also

And you need to use GET request with the permitted queries[like your second example] (term, terms, match, query_string, simple_query_string). Refer

Gibbs
  • 21,904
  • 13
  • 74
  • 138