Search multiple data streams and indices

To search multiple data streams and indices, add them as comma-separated values in the search API‘s request path.

The following request searches the my-index-000001 and my-index-000002 indices.

  1. GET /my-index-000001,my-index-000002/_search
  2. {
  3. "query": {
  4. "match": {
  5. "user.id": "kimchy"
  6. }
  7. }
  8. }

You can also search multiple data streams and indices using an index pattern.

The following request targets the my-index-* index pattern. The request searches any data streams or indices in the cluster that start with my-index-.

  1. GET /my-index-*/_search
  2. {
  3. "query": {
  4. "match": {
  5. "user.id": "kimchy"
  6. }
  7. }
  8. }

To search all data streams and indices in a cluster, omit the target from the request path. Alternatively, you can use _all or *.

The following requests are equivalent and search all data streams and indices in the cluster.

  1. GET /_search
  2. {
  3. "query": {
  4. "match": {
  5. "user.id": "kimchy"
  6. }
  7. }
  8. }
  9. GET /_all/_search
  10. {
  11. "query": {
  12. "match": {
  13. "user.id": "kimchy"
  14. }
  15. }
  16. }
  17. GET /*/_search
  18. {
  19. "query": {
  20. "match": {
  21. "user.id": "kimchy"
  22. }
  23. }
  24. }

Index boost

When searching multiple indices, you can use the indices_boost parameter to boost results from one or more specified indices. This is useful when hits coming from some indices matter more than hits from other.

You cannot use indices_boost with data streams.

  1. GET /_search
  2. {
  3. "indices_boost": [
  4. { "my-index-000001": 1.4 },
  5. { "my-index-000002": 1.3 }
  6. ]
  7. }

Index aliases and index patterns can also be used:

  1. GET /_search
  2. {
  3. "indices_boost": [
  4. { "my-alias": 1.4 },
  5. { "my-index*": 1.3 }
  6. ]
  7. }

If multiple matches are found, the first match will be used. For example, if an index is included in alias1 and matches the my-index* pattern, a boost value of 1.4 is applied.