{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/elasticsearch/issues/17438","repository_url":"https://api.github.com/repos/elastic/elasticsearch","labels_url":"https://api.github.com/repos/elastic/elasticsearch/issues/17438/labels{/name}","comments_url":"https://api.github.com/repos/elastic/elasticsearch/issues/17438/comments","events_url":"https://api.github.com/repos/elastic/elasticsearch/issues/17438/events","html_url":"https://github.com/elastic/elasticsearch/issues/17438","id":144823970,"number":17438,"title":"Merge multiple searches on aliases pointing to the same index","user":{"login":"KlavsKlavsen","id":2737885,"avatar_url":"https://avatars.githubusercontent.com/u/2737885?v=3","gravatar_id":"","url":"https://api.github.com/users/KlavsKlavsen","html_url":"https://github.com/KlavsKlavsen","followers_url":"https://api.github.com/users/KlavsKlavsen/followers","following_url":"https://api.github.com/users/KlavsKlavsen/following{/other_user}","gists_url":"https://api.github.com/users/KlavsKlavsen/gists{/gist_id}","starred_url":"https://api.github.com/users/KlavsKlavsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KlavsKlavsen/subscriptions","organizations_url":"https://api.github.com/users/KlavsKlavsen/orgs","repos_url":"https://api.github.com/users/KlavsKlavsen/repos","events_url":"https://api.github.com/users/KlavsKlavsen/events{/privacy}","received_events_url":"https://api.github.com/users/KlavsKlavsen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-31T08:21:34Z","updated_at":"2016-03-31T18:19:14Z","closed_at":"2016-03-31T18:19:14Z","body":"**Describe the feature**:\r\nMost of my searches are on the last day or two.. so I use daily indexes (for logs - from logstash).\r\n\r\nBut I get 100 mill. + logs easily per day.. and some have the insane idea that they want to be allowed to search for f.ex. 1 year.. That eats up a lot of memory in index space.\r\n\r\nSo I'd like to be able to merge older indexes into larger indexes.. with the new reindex api and alias'es - thats easy.\r\n\r\nOnly issue left, is that kibana will still search on every daily index.. even though they would now be an alias for the same weekly (or monthly) index.. meaning I would get 30 searches run on the same index.. instead of just 1.. I asked on irc and Warkholm stated that ES does not in fact recognize when this happens..\r\n\r\nI would like ES to actually detect this fact, when searching on aliases.. so 30 searches are merged into one in this case :)"},"comment":{"url":"https://api.github.com/repos/elastic/elasticsearch/issues/comments/204063085","html_url":"https://github.com/elastic/elasticsearch/issues/17438#issuecomment-204063085","issue_url":"https://api.github.com/repos/elastic/elasticsearch/issues/17438","id":204063085,"user":{"login":"clintongormley","id":56599,"avatar_url":"https://avatars.githubusercontent.com/u/56599?v=3","gravatar_id":"","url":"https://api.github.com/users/clintongormley","html_url":"https://github.com/clintongormley","followers_url":"https://api.github.com/users/clintongormley/followers","following_url":"https://api.github.com/users/clintongormley/following{/other_user}","gists_url":"https://api.github.com/users/clintongormley/gists{/gist_id}","starred_url":"https://api.github.com/users/clintongormley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clintongormley/subscriptions","organizations_url":"https://api.github.com/users/clintongormley/orgs","repos_url":"https://api.github.com/users/clintongormley/repos","events_url":"https://api.github.com/users/clintongormley/events{/privacy}","received_events_url":"https://api.github.com/users/clintongormley/received_events","type":"User","site_admin":false},"created_at":"2016-03-31T18:19:14Z","updated_at":"2016-03-31T18:19:14Z","body":"Hi @KlavsKlavsen \r\n\r\n> Only issue left, is that kibana will still search on every daily index.. even though they would now be an alias for the same weekly (or monthly) index.. meaning I would get 30 searches run on the same index.. instead of just 1.. I asked on irc and Warkholm stated that ES does not in fact recognize when this happens..\r\n\r\nI'm not sure where @markwalkom got that idea... aliases are reduced to a unique list of the corresponding indices\r\n\r\n    PUT t/t/1\r\n    {}\r\n    \r\n    PUT t/_alias/x\r\n    PUT t/_alias/y\r\n    \r\n    GET x,y/_validate/query?explain\r\n\r\nreturns:\r\n\r\n    \"explanations\": [\r\n      {\r\n        \"index\": \"t\",\r\n        \"valid\": true,\r\n        \"explanation\": \"*:*\"\r\n      }\r\n    ]\r\n\r\nIt even knows how to combine filtered aliases on the same index correctly"}}