You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/api-conventions.asciidoc
+42Lines changed: 42 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -264,6 +264,48 @@ GET _cluster/state/metadata?filter_path=metadata.indices.*.system
264
264
WARNING: When overwriting current cluster state, system indices should be restored
265
265
as part of their {ref}/snapshot-restore.html#feature-state[feature state].
266
266
267
+
[discrete]
268
+
[[node-spec-convention]]
269
+
==== Node specification
270
+
271
+
Some cluster-level APIs may operate on a subset of the nodes which can be specified with node filters. For example, task management, node stats, and node info APIs can all report results from a filtered set of nodes rather than from all nodes. <<cluster-nodes,Learn more>>.
272
+
273
+
[discrete]
274
+
[[component-selectors]]
275
+
==== Component selectors
276
+
277
+
A data stream component is a logical grouping of indices that help organize data inside a data stream. All data streams contain a `data` component by default. The `data` component comprises the data stream's backing indices. When searching, managing, or indexing into a data stream, the data component is what you are interacting with by default.
278
+
279
+
Some data stream features are exposed as additional components alongside its `data` component. These other components are comprised of separate sets of backing indices. These additional components store supplemental data independent of the data stream's regular backing indices. An example of another component is the `failures` component exposed by the data stream <<failure-store, failure store>> feature, which captures documents that fail to be ingested in a separate set of backing indices on the data stream.
280
+
281
+
Some APIs that accept a `<data-stream>`, `<index>`, or `<target>` request path parameter also support selector syntax which defines which component on a data stream the API should operate on. To use a selector, it is appended to the index or data stream name. Selectors can be combined with other index pattern syntax like <<api-date-math-index-names,date math>> and wildcards.
282
+
283
+
There are two selector suffixes supported by Elasticsearch APIs:
284
+
285
+
`::data`::
286
+
Refers to a data stream's backing indices containing regular data. Data streams always contain a data component.
287
+
`::failures`::
288
+
This component refers to the internal indices used for a data stream's <<failure-store, failure store>>.
289
+
290
+
As an example, <<search>>, <<search-field-caps,field capabilities>>, and <<indices-stats,index stats>> APIs can all report results from a different component rather than from the default data.
291
+
292
+
[source,console]
293
+
----
294
+
# Search a data stream normally
295
+
GET my-data-stream/_search
296
+
297
+
# Search a data stream's failure data if present
298
+
GET my-data-stream::failures/_search
299
+
300
+
# Syntax can be combined with other index pattern syntax (wildcards, multi-target, date math, cross cluster search, etc)
301
+
GET logs-*::failures/_search
302
+
GET logs-*::data,logs-*::failures/_count
303
+
GET remote-cluster:logs-*-*::failures/_search
304
+
GET *::data,*::failures,-logs-rdbms-*::failures/_stats
0 commit comments