How To Solve Issues Related to Log – Failed to add alias . filter

Prevent Your Next ELK Incident

Try our free Check Up to test if your ES issues are caused from misconfigured settings

Fix Issue

Updated: Feb-20

In-Page Navigation (click to jump) :

Opster Offer’s World-Class Elasticsearch Expertise In One Powerful Product
Try Our Free ES Check-Up   Prevent Incident

Troubleshooting background

To troubleshoot Elasticsearch log “Failed to add alias . filter” it’s important to understand common problems related to Elasticsearch concepts: alias, cluster, filter, indices. See detailed explanations below complete with common problems, examples and useful tips.

Alias in Elasticsearch

In Elasticsearch, an alias is a secondary name to refer to one or more indices. Aliases can be created and removed dynamically using _aliases REST endpoint.

What it is used for

Aliases are used for multiple purposes such as to search across more than one index with a single name, perform the reindexing process with zero downtime and query data based on predefined filters.

Examples

Creating an alias on a single index:

POST /_aliases?pretty
{
  "actions": [
    {
      "add": {
        "index": "index_1",
        "alias": "alias_1"
      }
    }
  ]
}

Creating the same alias on more than one index:

POST /_aliases?pretty
{
  "actions": [
    {
      "add": {
        "index": "index_1",
        "alias": "alias_1"
      }
    },
    {
      "add": {
        "index": "index_2",
        "alias": "alias_1"
      }
    }
  ]
}

Creating a filter-based alias:

POST /_aliases?pretty
{
  "actions": [
    {
      "add": {
        "index": "index_1",
        "alias": "alias_2",
        "filter": {
          "term": {
            "organization": "opster"
          }
        }
      }
    }
  ]
}

Listing out all of the available aliases in an Elasticsearch cluster:

GET _cat/aliases

Removing an alias:

POST /_aliases?pretty
{
  "actions": [
    {
      "remove": {
        "index": "index_2",
        "alias": "alias_1"
      }
    }
  ]
}
Notes
  • An Alias cannot be used for the indexing process if it points to more than one index. If attempted, Elasticsearch will throw an exception.
  • Deleting an alias does not delete the actual index.
Common Problems
  • Since a single alias can be attached to multiple indices, it is important to keep in mind that querying an alias will send the query against all the associated indices and this can impact the search performance and high resource utilization.

Cluster in Elasticsearch

What is it

In Elasticsearch a cluster is a collection of one or more nodes (servers / VMs). A cluster can consist of an unlimited number of nodes. The cluster provides interface for indexing and storing data and search capability across all of the data which is stored in the data nodes

Each cluster has a single master node that is elected by the master eligible nodes. In cases where the master is not available the other connected master eligible nodes elect a new master. Clusters are identified by a unique name, which defaults to “Elasticsearch”.

Filter in Elasticsearch


A filter in Elasticsearch is all about applying some conditions inside the query that are used to narrow down the matching result set.

What it is used for

When a query is executed, Elasticsearch by default calculates the relevance score of the matching documents.  But in some conditions it does not require scores to be calculated, for instance if a document falls in the range of two given timestamps. For all these Yes/No criteria, a filter clause is used.

Examples

Return all the results of a given index that falls between a date range:

GET my_index/_search
{
  "query": {
    "bool": {
      "filter": {
        "range": {
          "created_at": {
            "gte": "2020-01-01",
            "lte": "2020-01-10"
          }
        }
      }
    }
  }
}

Notes
  • Queries are used to find out how relevant a document is to a particular query by calculating a score for each document, whereas filters are used to match certain criteria and are cacheable to enable faster execution.
  • Filters do not contribute to scoring and thus are faster to execute.
  • There are major changes introduced in Elasticsearch version 2.x onward related to how query and filters are written and performed internally.

Common Problems
  • The most common problem with filters is incorrect use inside the query. If filters are not used correctly, query performance can be significantly affected. So filters must be used wherever there is scope of not calculating the score. 
  • Another problem often arises when using date range filters, if “now” is used to represent the current time. It has to be noted that “now” is continuously changing the timestamp and thus Elasticsearch cannot use caching of the response since the data set will keep changing.

To help troubleshoot related issues we have gathered selected Q&A from the community and issues from Github , please review the following for further information :

1 Why are my Elasticsearch shards sporadically failing when running queries against my alias filter? 0.19 K 2

2Github Issue Number 10609  


Log Context

Log ”[{}] failed to add alias [{}]; filter [{}]” classname is IndicesClusterStateService.java
We have extracted the following from Elasticsearch source code to get an in-depth context :

                         }
                        newAliases.put(alias; indexAliasesService.create(alias; filter));
                    }
                }
            } catch (Throwable e) {
                logger.warn("[{}] failed to add alias [{}]; filter [{}]"; e; index; alias; filter);
            }
        }
        indexAliasesService.addAll(newAliases);
    }







About Opster

Incorporating deep knowledge and broad history of Elasticsearch issues. Opster’s solution identifies and predicts root causes of Elasticsearch problems, provides recommendations and can automatically perform various actions to manage, troubleshoot and prevent issues.

Learn more: Glossary | Blog| Troubleshooting guides | Error Repository

Need help with any Elasticsearch issue ? Contact Opster