IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Retrieve selected fields from a search Collapse search results »

› › ›

Search multiple data streams and indices

edit

Search multiple data streams and indices

edit

To search multiple data streams and indices, add them as comma-separated values in the search API's request path.

The following request searches the my-index-000001 and my-index-000002 indices.

response = client.search(
  index: 'my-index-000001,my-index-000002',
  body: {
    query: {
      match: {
        'user.id' => 'kimchy'
      }
    }
  }
)
puts response

GET /my-index-000001,my-index-000002/_search
{
  "query": {
    "match": {
      "user.id": "kimchy"
    }
  }
}

You can also search multiple data streams and indices using an index pattern.

The following request targets the my-index-* index pattern. The request searches any data streams or indices in the cluster that start with my-index-.

response = client.search(
  index: 'my-index-*',
  body: {
    query: {
      match: {
        'user.id' => 'kimchy'
      }
    }
  }
)
puts response

GET /my-index-*/_search
{
  "query": {
    "match": {
      "user.id": "kimchy"
    }
  }
}

To search all data streams and indices in a cluster, omit the target from the request path. Alternatively, you can use _all or *.

The following requests are equivalent and search all data streams and indices in the cluster.

response = client.search(
  body: {
    query: {
      match: {
        'user.id' => 'kimchy'
      }
    }
  }
)
puts response

response = client.search(
  index: '_all',
  body: {
    query: {
      match: {
        'user.id' => 'kimchy'
      }
    }
  }
)
puts response

response = client.search(
  index: '*',
  body: {
    query: {
      match: {
        'user.id' => 'kimchy'
      }
    }
  }
)
puts response

GET /_search
{
  "query": {
    "match": {
      "user.id": "kimchy"
    }
  }
}

GET /_all/_search
{
  "query": {
    "match": {
      "user.id": "kimchy"
    }
  }
}

GET /*/_search
{
  "query": {
    "match": {
      "user.id": "kimchy"
    }
  }
}

Index boost

edit

When searching multiple indices, you can use the indices_boost parameter to boost results from one or more specified indices. This is useful when hits coming from some indices matter more than hits from other.

You cannot use indices_boost with data streams.

response = client.search(
  body: {
    indices_boost: [
      {
        "my-index-000001": 1.4
      },
      {
        "my-index-000002": 1.3
      }
    ]
  }
)
puts response

GET /_search
{
  "indices_boost": [
    { "my-index-000001": 1.4 },
    { "my-index-000002": 1.3 }
  ]
}

Aliases and index patterns can also be used:

response = client.search(
  body: {
    indices_boost: [
      {
        "my-alias": 1.4
      },
      {
        "my-index*": 1.3
      }
    ]
  }
)
puts response

GET /_search
{
  "indices_boost": [
    { "my-alias":  1.4 },
    { "my-index*": 1.3 }
  ]
}

If multiple matches are found, the first match will be used. For example, if an index is included in alias1 and matches the my-index* pattern, a boost value of 1.4 is applied.

« Retrieve selected fields from a search Collapse search results »