How to search in elasticsearch indexes starting with a string

Question

I am still new with elasticsearch and trying to find the best way how to filter results from a range of indices.

i.e.: Filebeat and logstash use to create index per day. I use to use bot for an different purpose and parallel I am using a posix shell script which is parsing and indexing some files from archive. Hence I have 3 types of indexes:

archive
logs
processing

archive and logs are generated with date in the name:

archive-2015.12.31
archive-2016.01.04
logs-2015.12.31
logs-2016.01.04

I have tried various of attempts, but no success.

How to build the URI if I want to search only in logs or only in archive?

Many thanks Regards Reddy

bittusarkar · Accepted Answer · 2016-01-04 09:00:55Z

2

You can use wildcards in the index name. If you want to search all documents in indices whose name start with "logs", the corresponding query is:

POST logs*/_search
{
    "query": {
        "match_all": {}
    }
}

Read this for more information.

answered Jan 4, 2016 at 9:00

bittusarkar

6,3674 gold badges36 silver badges51 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Reddy SK Over a year ago

Thank you very much. That's weird. It is one of first thing I have tried and didn't work. Now it is working. Something weird sits between my keyboard and chair :) Thank you again! Reddy

Collectives™ on Stack Overflow

How to search in elasticsearch indexes starting with a string

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related