Index aliases in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What is the output of this alias query?

Given an Elasticsearch index alias products_current pointing to the index products_2024, what will the following query return?

{"query": {"match_all": {}}}

when executed on the alias products_current?

Elasticsearch

GET /products_current/_search
{
  "query": {
    "match_all": {}
  }
}

A Returns an error because the alias name is invalid

B Returns no documents because aliases cannot be queried directly

C Returns documents only if the alias has a filter defined

D Returns all documents from the index products_2024

💡 Hint

Think about what an alias does in Elasticsearch.

An alias in Elasticsearch acts as a pointer to one or more indices. Querying an alias is equivalent to querying the underlying index or indices it points to. Since products_current points to products_2024, the query returns all documents from that index.

🧠 Conceptual

intermediate

How does an alias with a filter affect search results?

If an alias active_users points to the index users with a filter {"term": {"status": "active"}}, what will a search on active_users return?

A All documents in the <code>users</code> index regardless of status

B No documents because filters on aliases are ignored

C Only documents where the field <code>status</code> is <code>active</code>

D An error because filters cannot be applied on aliases

💡 Hint

Consider how alias filters limit visible documents.

Alias filters restrict the documents visible through that alias. Searching the alias active_users returns only documents matching the filter, i.e., where status is active.

📝 Syntax

advanced

Which option correctly creates an alias with a filter?

Choose the correct JSON syntax to create an alias recent_orders for the index orders that only shows documents where order_date is after 2024-01-01.

Elasticsearch

PUT /orders/_alias/recent_orders
{
  "filter": {
    "range": {
      "order_date": {
        "gt": "2024-01-01"
      }
    }
  }
}

A { "filter": { "range": { "order_date": { "gt": "2024-01-01" } } } }

B { "query": { "range": { "order_date": { "gt": "2024-01-01" } } } }

C { "filter": { "term": { "order_date": "2024-01-01" } } }

D { "alias": { "filter": { "range": { "order_date": { "gte": "2024-01-01" } } } } }

💡 Hint

Alias filters use the filter key, not query.

The correct syntax uses the filter key with a range query. Option A matches the correct structure. Option A uses query which is invalid for alias filters. Option A uses term which does not specify a range. Option A has an invalid alias wrapper.

❓ optimization

advanced

Why use aliases for zero-downtime reindexing?

You want to update your Elasticsearch index products_v1 to products_v2 without downtime. How do aliases help?

A Aliases cannot help with zero-downtime reindexing

B Point the alias <code>products</code> to <code>products_v2</code> after reindexing, so clients query the alias without changing code

C Use aliases to merge both indices into one automatically

D Delete <code>products_v1</code> and rename <code>products_v2</code> to <code>products_v1</code> directly

💡 Hint

Think about how aliases abstract index names.

Aliases allow you to switch the pointer from the old index to the new index instantly. Clients query the alias name, so no code changes are needed. This enables zero downtime during reindexing.

🔧 Debug

expert

Why does this alias creation fail?

You run this command to create an alias with a filter:

PUT /logs/_alias/error_logs
{
  "filter": {
    "term": {
      "level": "error"
    }
  },
  "routing": "error"
}

But you get an error. What is the cause?

A The alias creation fails because <code>routing</code> is not allowed with <code>filter</code>

B The alias creation fails because <code>routing</code> must be a number, not a string

C The alias creation fails because <code>routing</code> must be inside <code>filter</code>

D The alias creation fails because the <code>term</code> filter syntax is incorrect

💡 Hint

Check Elasticsearch alias API rules for routing and filter.

Elasticsearch does not allow setting routing and filter together in the same alias definition. You must choose one or create separate aliases.

Practice

1.

What is the main purpose of using index aliases in Elasticsearch?

easy

A. To use simple names instead of real index names for easier access

B. To permanently rename an index

C. To delete multiple indexes at once

D. To backup indexes automatically

Solution

1. Step 1: Understand what index aliases do

   Index aliases provide a way to refer to one or more indexes using a simple name.

2. Step 2: Compare options with this purpose

   Only To use simple names instead of real index names for easier access describes using simple names instead of real index names, which matches the purpose of aliases.

3. Final Answer:

   To use simple names instead of real index names for easier access -> Option A

4. Quick Check:

   Index aliases simplify index names = D [OK]

Hint: Aliases are easy names for indexes, not permanent renames [OK]

Common Mistakes:

• Thinking aliases rename indexes permanently
• Confusing aliases with backup or delete functions
• Assuming aliases are only for single indexes

2.

Which of the following is the correct syntax to add an alias named logs_current to an index called logs_2024 using Elasticsearch API?

{
  "actions": [
    {
      "add": {
        "index": "logs_2024",
        "alias": "logs_current"
      }
    }
  ]
}

easy

A. PUT /logs_current { "index": "logs_2024" }

B. POST /_aliases { "actions": [{ "add": { "index": "logs_2024", "alias": "logs_current" } }] }

C. GET /logs_2024/_alias/logs_current

D. DELETE /_aliases { "actions": [{ "remove": { "index": "logs_2024", "alias": "logs_current" } }] }

Solution

1. Step 1: Identify the correct API endpoint and method

   Adding an alias uses POST on /_aliases with an actions array.

2. Step 2: Match the syntax with the options

   POST /_aliases { "actions": [{ "add": { "index": "logs_2024", "alias": "logs_current" } }] } correctly uses POST /_aliases with the add action and proper JSON structure.

3. Final Answer:

   POST /_aliases with add action JSON -> Option B

4. Quick Check:

   Adding alias uses POST /_aliases = A [OK]

Hint: Add aliases with POST /_aliases and actions array [OK]

Common Mistakes:

• Using PUT on alias name instead of POST on /_aliases
• Using GET to add an alias (GET is for reading)
• Confusing remove action with add

3.

Given these aliases and indexes:
logs_2023, logs_2024
Alias logs_all points to both indexes.
Which index will be searched when querying logs_all?

medium

A. Only logs_2023

B. Only logs_2024

C. No index, alias is invalid

D. Both logs_2023 and logs_2024

Solution

1. Step 1: Understand alias pointing to multiple indexes

   An alias can point to many indexes, so searching the alias searches all linked indexes.

2. Step 2: Apply to given alias logs_all

   Since logs_all points to both logs_2023 and logs_2024, queries to it search both indexes.

3. Final Answer:

   Both logs_2023 and logs_2024 -> Option D

4. Quick Check:

   Alias to multiple indexes searches all = C [OK]

Hint: Aliases can point to many indexes, searching all at once [OK]

Common Mistakes:

• Assuming alias searches only one index
• Thinking alias must be single index
• Believing alias is invalid if multiple indexes linked

4.

What is wrong with this alias update request?

{
  "actions": [
    {
      "add": {
        "alias": "current_logs",
        "index": "logs_2024"
      }
    },
    {
      "remove": {
        "alias": "old_logs",
        "index": "logs_2023"
      }
    }
  ]
}

Sent as POST to /_aliases.

medium

A. The request is correct and will work as expected

B. The JSON keys alias and index are swapped

C. The order of add and remove actions must be reversed

D. The HTTP method should be PUT, not POST

Solution

1. Step 1: Check JSON structure for alias actions

   The actions array correctly uses add and remove with keys alias and index in correct places.

2. Step 2: Verify HTTP method and endpoint

   POST to /_aliases is the correct way to update aliases.

3. Final Answer:

   The request is correct and will work as expected -> Option A

4. Quick Check:

   Correct alias update uses POST /_aliases with add/remove = A [OK]

Hint: POST /_aliases with add/remove actions is correct syntax [OK]

Common Mistakes:

• Thinking order of actions matters
• Swapping alias and index keys
• Using PUT instead of POST for alias updates

5.

You want to switch an alias active_logs from pointing to logs_2023 to logs_2024 without downtime. Which is the best approach?

hard

A. Remove alias from logs_2023 then add alias to logs_2024 in two separate requests

B. Delete logs_2023 index and then add alias to logs_2024

C. Use a single atomic alias update request with both remove and add actions

D. Create a new alias with a different name for logs_2024

Solution

1. Step 1: Understand alias switching without downtime

   Switching alias atomically avoids downtime by updating both remove and add in one request.

2. Step 2: Evaluate options for atomic update

   Use a single atomic alias update request with both remove and add actions uses a single request with remove and add actions, ensuring no downtime.

3. Final Answer:

   Use a single atomic alias update request with both remove and add actions -> Option C

4. Quick Check:

   Atomic alias update = remove + add in one request = B [OK]

Hint: Switch aliases atomically with one request to avoid downtime [OK]

Common Mistakes:

• Doing remove and add in separate requests causing downtime
• Deleting index instead of switching alias
• Creating new alias instead of switching existing one