From 30b66345b81a7e4b0ffe62197f1164ff22fe4fa7 Mon Sep 17 00:00:00 2001 From: Kofi Bartlett Date: Tue, 21 Jan 2025 20:06:11 -0800 Subject: [PATCH 1/6] [DOCS] Search multiple indices added info --- .../search-multiple-indices.asciidoc | 35 ++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc index 4052097e73c91..889fa0d9a5c41 100644 --- a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc +++ b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc @@ -1,5 +1,11 @@ [[search-multiple-indices]] -=== Search multiple data streams and indices +=== Search multiple data streams and indices using a query + +There are two primary ways to search across multiple data streams and indices: + +* At the query level: Specify the indices directly in the search request path or use index patterns to target a group of indices. + +* At the index level: Use <>, which act as pointers to one or more backing indices, allowing you to group and manage indices logically. To search multiple data streams and indices, add them as comma-separated values in the <>'s request path. @@ -39,6 +45,33 @@ GET /my-index-*/_search ---- // TEST[setup:my_index] +You can also remove a subset of indices from being searched. The request will retun data from all indices that start with `my-index-` while excluding results from `my-index-01`. + +[source,console] +---- +GET /my-index-*/_search +{ + "query": { + "bool": { + "must": [ + { + "match": { + "user.id": "kimchy" + } + } + ], + "must_not": [ + { + "terms": { + "_index": ["my-index-01"] + } + } + ] + } + } +} +---- + To search all data streams and indices in a cluster, omit the target from the request path. Alternatively, you can use `_all` or `*`. From 5c93117357bd6db8d6a5923c5829f871b6add12a Mon Sep 17 00:00:00 2001 From: Kofi B Date: Tue, 28 Jan 2025 10:47:59 -0800 Subject: [PATCH 2/6] Update docs/reference/search/search-your-data/search-multiple-indices.asciidoc Co-authored-by: George Wallace --- .../search/search-your-data/search-multiple-indices.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc index 889fa0d9a5c41..acd9bef107ebe 100644 --- a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc +++ b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc @@ -1,7 +1,7 @@ [[search-multiple-indices]] === Search multiple data streams and indices using a query -There are two primary ways to search across multiple data streams and indices: +There are two main methods for searching across multiple data streams and indices in {es}: * At the query level: Specify the indices directly in the search request path or use index patterns to target a group of indices. From f3dfc31b634f664ba0ab85fab25e4203bb421414 Mon Sep 17 00:00:00 2001 From: Kofi B Date: Tue, 28 Jan 2025 10:48:20 -0800 Subject: [PATCH 3/6] Update docs/reference/search/search-your-data/search-multiple-indices.asciidoc Co-authored-by: George Wallace --- .../search/search-your-data/search-multiple-indices.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc index acd9bef107ebe..5b0f491a3a728 100644 --- a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc +++ b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc @@ -3,7 +3,7 @@ There are two main methods for searching across multiple data streams and indices in {es}: -* At the query level: Specify the indices directly in the search request path or use index patterns to target a group of indices. +* *Query Level*: Directly specify indices in the search request path or use index patterns to target multiple indices. * At the index level: Use <>, which act as pointers to one or more backing indices, allowing you to group and manage indices logically. From 5635573b14b155ca9d9d732e18151e5d55dd763e Mon Sep 17 00:00:00 2001 From: Kofi B Date: Tue, 28 Jan 2025 10:48:50 -0800 Subject: [PATCH 4/6] Update docs/reference/search/search-your-data/search-multiple-indices.asciidoc Co-authored-by: George Wallace --- .../search/search-your-data/search-multiple-indices.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc index 5b0f491a3a728..f8c74c19d637c 100644 --- a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc +++ b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc @@ -5,7 +5,7 @@ There are two main methods for searching across multiple data streams and indice * *Query Level*: Directly specify indices in the search request path or use index patterns to target multiple indices. -* At the index level: Use <>, which act as pointers to one or more backing indices, allowing you to group and manage indices logically. +* *Index level*: Use <>, which act as pointers to one or more backing indices, enabling logical grouping and management of indices. To search multiple data streams and indices, add them as comma-separated values in the <>'s request path. From 481c84eda84becbfdd3fe013d7e9cc586f9d12fb Mon Sep 17 00:00:00 2001 From: Kofi B Date: Tue, 28 Jan 2025 10:49:04 -0800 Subject: [PATCH 5/6] Update docs/reference/search/search-your-data/search-multiple-indices.asciidoc Co-authored-by: George Wallace --- .../search/search-your-data/search-multiple-indices.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc index f8c74c19d637c..0322be598544e 100644 --- a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc +++ b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc @@ -71,6 +71,7 @@ GET /my-index-*/_search } } ---- +// TEST[setup:my_index] To search all data streams and indices in a cluster, omit the target from the request path. Alternatively, you can use `_all` or `*`. From 998e5c474753e8758357275cb254c48b53af7667 Mon Sep 17 00:00:00 2001 From: Kofi B Date: Tue, 28 Jan 2025 10:49:31 -0800 Subject: [PATCH 6/6] Update docs/reference/search/search-your-data/search-multiple-indices.asciidoc Co-authored-by: George Wallace --- .../search/search-your-data/search-multiple-indices.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc index 0322be598544e..f02e10640a6d9 100644 --- a/docs/reference/search/search-your-data/search-multiple-indices.asciidoc +++ b/docs/reference/search/search-your-data/search-multiple-indices.asciidoc @@ -45,7 +45,7 @@ GET /my-index-*/_search ---- // TEST[setup:my_index] -You can also remove a subset of indices from being searched. The request will retun data from all indices that start with `my-index-` while excluding results from `my-index-01`. +You can exclude specific indices from a search. The request will retrieve data from all indices starting with `my-index-`, except for `my-index-01`. [source,console] ----