63

I have an elasticsearch cluster with 3 indexes:

/users/user
/events/visit
/events/register
/pages/page

So, now I need to run queries processing multiple indexes.

Eg: Get gender of users registered in page X. (To get this info, I need infos from multiple indexes.)

Is this possible? Maybe integrating hadoop?

user3175226
  • 3,579
  • 7
  • 28
  • 47

3 Answers3

90

This is quite easy within Elasticsearch itself! Anytime you would specify an index, you can separate additional indices by comma.

curl -XGET 'http://localhost:9200/index1,index2/_search?q=yourQueryHere'

You can also search all indices with _all.

curl -XGET 'http://localhost:9200/_all/_search?q=yourQueryHere'

Here's some helpful documentation from elasticsearch's website. This site has TONS of info, but it is a bit difficult to find sometimes, IMO.

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-index.html

Jay Lim
  • 371
  • 3
  • 14
Brian Mego
  • 1,439
  • 11
  • 10
  • I found information that _all will be deprecated (https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-all-field.html) , but I'm not sure if elastic search has several uses for "_all", so perhaps it's a fake new :D, please update your answer @brian-mego if you know something about it – chomp Apr 22 '18 at 14:41
  • can we do it for the date range like CURL -XGET 'http://localhost:9200/index_2018-12-{15-25}/_search' means I wanted to select only data from index 15 to 25 not more or else, I have the index for per day basis. – Indrajeet Gour Dec 10 '18 at 09:28
  • @IndrajeetGour, the [conventions for multiple indices doc](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-index.html) says it support wildcards, like `*` and `-`, but it doesn't mention about range – Ricardo Jan 17 '19 at 02:00
  • you can create alias and hook all indices behind it. query to alias and get all relevant docs. – Karn_way Mar 07 '19 at 13:29
  • 1
    @Brian Can we limit result on the basis of an index. Suppose we want the top 5 results from index1 and the top 5 from index2. Can we achieve this in elastic search. – Pulkit Aggarwal Dec 24 '19 at 09:07
  • Thx for the `_all` hint! – Kalnode Jan 31 '21 at 15:45
8

By not limiting our search to a particular index or type, we have searched across all documents in the cluster. Elasticsearch forwarded the search request in parallel to a primary or replica of every shard in the cluster.

       1)/users,events,pages/_search : Search all types in the users,events and pages

       2)/u*,e*,p*/_search : Search all types in any indices beginning with u,e or beginning with p

       3)/events/visit,register/_search : Search types visit and register in the events index

       4) /_all/user,visit,register,page/_search : Search types users,events and pages in specified indices
Pavan Kumar Varma
  • 1,413
  • 1
  • 14
  • 22
2

It is possible to do search query through multiple indices:

for example:

curl -X POST \
'http://localhost:9200/test1,test2/_search?pretty=' \
-H 'Content-Type: application/json' -d '{
    "query": {
    ...
    }
}
'
Qy Zuo
  • 2,622
  • 24
  • 21