Index aliases in Elasticsearch - Time & Space Complexity

Time Complexity: Index aliases

O(n)

Understanding Time Complexity

When using index aliases in Elasticsearch, it's important to understand how the system handles queries through these aliases.

We want to know how the time to find data changes as the amount of data or number of aliases grows.

Scenario Under Consideration

Analyze the time complexity of this alias usage in Elasticsearch.

POST /_aliases
{
  "actions": [
    { "add": { "index": "products_v1", "alias": "products" } },
    { "add": { "index": "products_v2", "alias": "products" } }
  ]
}

GET /products/_search
{
  "query": { "match_all": {} }
}
    

This code adds two indices under one alias and then searches using the alias.

Identify Repeating Operations

Look at what repeats when searching through an alias.

• Primary operation: Searching each index behind the alias.
• How many times: Once per index linked to the alias.

How Execution Grows With Input

As the number of indices behind an alias grows, the search runs on each one.

Input Size (number of indices)	Approx. Operations
1	1 search operation
10	10 search operations
100	100 search operations

Pattern observation: The work grows directly with the number of indices behind the alias.

Final Time Complexity

Time Complexity: O(n)

This means the search time increases linearly with the number of indices the alias points to.

Common Mistake

[X] Wrong: "Searching through an alias is always as fast as searching one index."

[OK] Correct: Because the alias can point to many indices, Elasticsearch must search each one, so time grows with the number of indices.

Interview Connect

Understanding how aliases affect search time helps you explain real-world Elasticsearch performance and design choices clearly and confidently.

Self-Check

"What if the alias pointed to indices with very different sizes? How would that affect the overall search time complexity?"

Practice

1.

What is the main purpose of using index aliases in Elasticsearch?

easy

A. To use simple names instead of real index names for easier access

B. To permanently rename an index

C. To delete multiple indexes at once

D. To backup indexes automatically

Solution

1. Step 1: Understand what index aliases do

   Index aliases provide a way to refer to one or more indexes using a simple name.

2. Step 2: Compare options with this purpose

   Only To use simple names instead of real index names for easier access describes using simple names instead of real index names, which matches the purpose of aliases.

3. Final Answer:

   To use simple names instead of real index names for easier access -> Option A

4. Quick Check:

   Index aliases simplify index names = D [OK]

Hint: Aliases are easy names for indexes, not permanent renames [OK]

Common Mistakes:

• Thinking aliases rename indexes permanently
• Confusing aliases with backup or delete functions
• Assuming aliases are only for single indexes

2.

Which of the following is the correct syntax to add an alias named logs_current to an index called logs_2024 using Elasticsearch API?

{
  "actions": [
    {
      "add": {
        "index": "logs_2024",
        "alias": "logs_current"
      }
    }
  ]
}

easy

A. PUT /logs_current { "index": "logs_2024" }

B. POST /_aliases { "actions": [{ "add": { "index": "logs_2024", "alias": "logs_current" } }] }

C. GET /logs_2024/_alias/logs_current

D. DELETE /_aliases { "actions": [{ "remove": { "index": "logs_2024", "alias": "logs_current" } }] }

Solution

1. Step 1: Identify the correct API endpoint and method

   Adding an alias uses POST on /_aliases with an actions array.

2. Step 2: Match the syntax with the options

   POST /_aliases { "actions": [{ "add": { "index": "logs_2024", "alias": "logs_current" } }] } correctly uses POST /_aliases with the add action and proper JSON structure.

3. Final Answer:

   POST /_aliases with add action JSON -> Option B

4. Quick Check:

   Adding alias uses POST /_aliases = A [OK]

Hint: Add aliases with POST /_aliases and actions array [OK]

Common Mistakes:

• Using PUT on alias name instead of POST on /_aliases
• Using GET to add an alias (GET is for reading)
• Confusing remove action with add

3.

Given these aliases and indexes:
logs_2023, logs_2024
Alias logs_all points to both indexes.
Which index will be searched when querying logs_all?

medium

A. Only logs_2023

B. Only logs_2024

C. No index, alias is invalid

D. Both logs_2023 and logs_2024

Solution

1. Step 1: Understand alias pointing to multiple indexes

   An alias can point to many indexes, so searching the alias searches all linked indexes.

2. Step 2: Apply to given alias logs_all

   Since logs_all points to both logs_2023 and logs_2024, queries to it search both indexes.

3. Final Answer:

   Both logs_2023 and logs_2024 -> Option D

4. Quick Check:

   Alias to multiple indexes searches all = C [OK]

Hint: Aliases can point to many indexes, searching all at once [OK]

Common Mistakes:

• Assuming alias searches only one index
• Thinking alias must be single index
• Believing alias is invalid if multiple indexes linked

4.

What is wrong with this alias update request?

{
  "actions": [
    {
      "add": {
        "alias": "current_logs",
        "index": "logs_2024"
      }
    },
    {
      "remove": {
        "alias": "old_logs",
        "index": "logs_2023"
      }
    }
  ]
}

Sent as POST to /_aliases.

medium

A. The request is correct and will work as expected

B. The JSON keys alias and index are swapped

C. The order of add and remove actions must be reversed

D. The HTTP method should be PUT, not POST

Solution

1. Step 1: Check JSON structure for alias actions

   The actions array correctly uses add and remove with keys alias and index in correct places.

2. Step 2: Verify HTTP method and endpoint

   POST to /_aliases is the correct way to update aliases.

3. Final Answer:

   The request is correct and will work as expected -> Option A

4. Quick Check:

   Correct alias update uses POST /_aliases with add/remove = A [OK]

Hint: POST /_aliases with add/remove actions is correct syntax [OK]

Common Mistakes:

• Thinking order of actions matters
• Swapping alias and index keys
• Using PUT instead of POST for alias updates

5.

You want to switch an alias active_logs from pointing to logs_2023 to logs_2024 without downtime. Which is the best approach?

hard

A. Remove alias from logs_2023 then add alias to logs_2024 in two separate requests

B. Delete logs_2023 index and then add alias to logs_2024

C. Use a single atomic alias update request with both remove and add actions

D. Create a new alias with a different name for logs_2024

Solution

1. Step 1: Understand alias switching without downtime

   Switching alias atomically avoids downtime by updating both remove and add in one request.

2. Step 2: Evaluate options for atomic update

   Use a single atomic alias update request with both remove and add actions uses a single request with remove and add actions, ensuring no downtime.

3. Final Answer:

   Use a single atomic alias update request with both remove and add actions -> Option C

4. Quick Check:

   Atomic alias update = remove + add in one request = B [OK]

Hint: Switch aliases atomically with one request to avoid downtime [OK]

Common Mistakes:

• Doing remove and add in separate requests causing downtime
• Deleting index instead of switching alias
• Creating new alias instead of switching existing one