-
Notifications
You must be signed in to change notification settings - Fork 172
Description
When setting up a transform, it is possible to specify in the destination of the transform the move_on_creation setting.
"dest": {
"index": "logs-ti_misp_latest.dest_threat_attributes-3",
"aliases": [
{
"alias": "logs-ti_misp_latest.threat_attributes",
"move_on_creation": true
}
]
Such a setting is not documented anywhere on our documentation. Only here in Terraform https://registry.terraform.io/providers/elastic/elasticstack/0.11.14/docs/resources/elasticsearch_transform#:~:text=move_on_creation%20(Boolean)%20Whether%20the%20destination%20index%20should%20be%20the%20only%20index%20in%20this%20alias.%20Defaults%20to%20false
move_on_creation
(Optional, boolean) Whether or not the destination index should be the only index in this alias. If true, all the other indices will be removed from this alias before adding the destination index to this alias. Defaults to false.
This is the explanation I got from Dev. move_on_creation: true controls alias behavior, NOT index deletion. When the destination index is created, move the alias to point to this new index.
One Example Scenario: If the alias logs-ti_misp_latest.threat_attributes was pointing to an older index (e.g., -1 or -2), it will now point to -3
The old index data remains, but queries using the alias will now hit the new index.