[BUG] Validation issue while adding/removing backing indices in aliases

[raghuvanshraj]

Describe the bug

There is a bug in the PUT _alias/{alias} API that does not validate the fields inside the payload when adding/removing backing indices. While this results in a no-op, ideally an exception should be thrown and an incorrect payload should not be rejected.

Related component

Indexing

To Reproduce

1. Create a new index
2. Create an alias with this index as a backing index and supply an incorrect field inside the add block
3. The service won't throw an error

Example:

PUT index-1

PUT _alias/alias-1
{
  "actions": [
    {
      "add": {
        "index": "index-1",
        "alias": "alias-1",
        "abcd": true
      }
    }
  ]
}

The response (unexpected) is the following:

{
  "acknowledged": true
}

Expected behavior

The service should throw an error in the above mentioned scenario as abcd is not a recognized field.

Additional Details

Plugins
NA

Screenshots
NA

Host/Environment (please complete the following information):
NA

Additional context
Sample attached above

[dblock]

Want to turn this into a (failing) YAML REST test?

[peternied]

[Triage - attendees 1 2 3 4 5]
@raghuvanshraj Thanks for filing, what do you think about creating a test cases to validate or better yet a pull request that fixes the issue?

[gaobinlong]

Actually there're two APIs we can add an index to an alias, the Aliases API and the Create or Update alias API, but there's some ambiguity between them, Aliases API only accept the URL POST _aliases and supports multiple alias actions like add, remove and remove_index, Create or update alias API can accept multiple URL paths but only support adding alias.

So for this issue, it targets the Create or update alias API because of the URL path, certainly there's a bug when parsing the request, we don't throw exception for unknown field, we need to fix it, but by my test the Aliases API doesn't have this problem. Another problem is that Create or update alias API doesn't support the actions parameter like the Aliases API, all parameters are in the top level:

PUT test1/_alias/alias-7
{
  "routing":"test"
}

or

PUT _alias/alias-7
{
  "index": "test1",
  "routing":"test"
}

, the usage is not as same as the Aliases API:

POST _aliases
{
  "actions": [
    {
      "add": {
       "index": "test1",
        "alias": "alias-100"
      }
    }
  ]
}

.

In conclusion, I think there're three things we need to do:

1. We only document the usage of the Aliases API , so we need to add documentation for the Create or update alias API to make the usage clear.
2. Add more yml test cases for the Create or update alias API because we don't have enough test cases to cover all usage:
   

   OpenSearch/rest-api-spec/src/main/resources/rest-api-spec/test/indices.put_alias/10_basic.yml

   Line 2 in 74230b7

   "Basic test for put alias":

3. Fix the bug of the parsing issue in Create or update alias API.

[gaobinlong]

Closed by #14719.