Skip to content

[Feedback]: Document move_on_creation setting in the create transform API #3755

@laraMorenoIgle

Description

@laraMorenoIgle

When setting up a transform, it is possible to specify in the destination of the transform the move_on_creation setting.

"dest": {
    "index": "logs-ti_misp_latest.dest_threat_attributes-3",
    "aliases": [
      {
        "alias": "logs-ti_misp_latest.threat_attributes",
        "move_on_creation": true
      }
    ]

Such a setting is not documented anywhere on our documentation. Only here in Terraform https://registry.terraform.io/providers/elastic/elasticstack/0.11.14/docs/resources/elasticsearch_transform#:~:text=move_on_creation%20(Boolean)%20Whether%20the%20destination%20index%20should%20be%20the%20only%20index%20in%20this%20alias.%20Defaults%20to%20false

move_on_creation
(Optional, boolean) Whether or not the destination index should be the only index in this alias. If true, all the other indices will be removed from this alias before adding the destination index to this alias. Defaults to false.

This is the explanation I got from Dev. move_on_creation: true controls alias behavior, NOT index deletion. When the destination index is created, move the alias to point to this new index.

One Example Scenario: If the alias logs-ti_misp_latest.threat_attributes was pointing to an older index (e.g., -1 or -2), it will now point to -3

The old index data remains, but queries using the alias will now hit the new index.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions