Conflicting behavior of data streams and querying for _aliases

[simitt]

Elasticsearch version (bin/elasticsearch --version): master

Description of the problem including expected versus actual behavior:
As soon as some data stream exists, trying to query an alias with GET /_alias/xyz results in a 400 response. As pointed out by @martijnvg the request is equivalent to GET /*/_alias/xyz which includes all indices/alias/data streams for aliases with the name xyz. Based on currently implemented validations querying for an alias on data streams results in an error.

The way to prevent this issue is to query GET xyz/_alias instead.

Unfortunately all beats and APM Server are currently impacted by this behavior. On startup or when running beat setup they send a request to check whether an alias exists or not in the above mentioned, conflicting way. As soon as any data stream exists, this results in an error and the beat can't start. While we could change the query for upcoming versions, this might still lead to compatibility issues with current beat versions.

Steps to reproduce:

1. Create index_template and send a document resulting in a data stream creation

PUT /_index_template/foo
{
  "index_patterns": ["foo*"],
  "priority": 0,
  "data_stream": {
    "timestamp_field": "@timestamp"
  },
  "composed_of": []
}
POST foo-test/_doc
{
  "count": 10
}

Check the data stream is created GET _data_stream/*

2. Create an ILM alias

PUT bar-test-000001 
{
  "aliases": {
    "bar-test":{
      "is_write_index": true 
    }
  }
}

3. Check ILM alias with

• GET /_alias/bar-test: returns 400 - "The provided expression [foo-test] matches a data stream, specify the corresponding concrete indices instead."
• GET bar-test/_alias: returns 200, works as expected.

[elasticmachine]

Pinging @elastic/es-core-features (:Core/Features/Data streams)

[simitt]

@martijnvg do you have a rough estimation of when the fix will arrive in master?

[danhermann]

@simitt, the fix is dependent on #58381 which is currently in review.