Aliases

OpenSearch supports index aliasing, which allows for addressing a uniform index name pointing to the active index. An indexes may be rotated daily, with a date suffix - e.g. accesslog-2026.03.24, accesslog-2026.03.25, etc. Whichever index is currently active can be represented by the index alias accesslog, in which case a log shipper won't need to change the destination index name every day.

Others prefer OpenSearch's built-in rollover mechanism where indexes are suffixed with a six digit incrementing number, e.g. accesslog-000001, accesslog-000002, etc. The rollover mechanism creates the next index when certain tresholds or limits are met, and updates the alias accordingly.

Aliases are initially set up from the Index management → Aliases page.

Preparing the index template for aliasing

To prepare an index for aliasing, add index.plugins.index_state_management.rollover_alias to the template settings. In the index template settings ( Index management → Templates), modify the Advanced settings JSON section along the lines of the following, replacing MySuperAlias with an appropriate name:

{
    [your existing settings],
    "index.plugins.index_state_management.rollover_alias": "MySuperAlias"
}

Automatic update of alias

If aliasing is configured, data retention policies will update aliases on rollover. Keep reading the article on Data retention for how to configure this.