Elasticsearch别名移除失败但新增正常，原因何在？

我向Elasticsearch发送了以下别名更新请求，预期先移除两个旧索引与iso27001-controls-followup-current别名的关联，再将新索引关联到该别名。但执行后查询发现新关联已生效，旧关联却未被移除。

发送的请求 #

PUT /_alias
{
  "actions": [
    {
      "remove": {
        "index": "iso27001-controls-followup-1678369933360",
        "alias": "iso27001-controls-followup-current"
      }
    },
    {
      "remove": {
        "index": "iso27001-controls-followup-1678452135114",
        "alias": "iso27001-controls-followup-current"
      }
    },
    {
      "add": {
        "index": "iso27001-controls-followup-1678455704228",
        "alias": "iso27001-controls-followup-current"
      }
    }
  ]
}

执行后的查询结果 #

执行以下查询：

GET /_cat/aliases/iso27001-controls-followup-current?format=json

返回结果显示所有旧索引仍与别名关联：

[
  {
    "alias": "iso27001-controls-followup-current",
    "index": "iso27001-controls-followup-1678452135114",
    "filter": "-",
    "routing.index": "-",
    "routing.search": "-",
    "is_write_index": "-"
  },
  {
    "alias": "iso27001-controls-followup-current",
    "index": "iso27001-controls-followup-1678455704228",
    "filter": "-",
    "routing.index": "-",
    "routing.search": "-",
    "is_write_index": "-"
  },
  {
    "alias": "iso27001-controls-followup-current",
    "index": "iso27001-controls-followup-1678369933360",
    "filter": "-",
    "routing.index": "-",
    "routing.search": "-",
    "is_write_index": "-"
  }
]

问题原因与解决方案 #

问题出在请求的端点路径上：你使用的是单数形式的/_alias，但Elasticsearch中支持批量别名操作（即通过actions数组执行多个add/remove操作）的正确端点是复数形式的/_aliases。

/_alias端点仅用于单个别名的创建或更新，它不会解析请求体中的actions数组——这意味着你提交的remove操作完全被忽略，只有add操作因为ES的容错逻辑被执行，最终导致旧关联未被移除。

将请求端点改为PUT /_aliases，保持请求体不变，即可正确执行批量的remove和add操作，达到预期效果。

内容的提问来源于stack exchange，提问作者WoJ