"GET _cat/indices" does not output all the indices

[raulk89 (Raul Kaubi)]

Hi

Elastic, kibana 7.15.1

This gives me 31 rows (30 indices in total and first row for heading)
GET _cat/indices/*?v&s=index:desc

health status index                           uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   metricbeat-7.15.1               Sg_Qw8L5TzGelnbN0kL0Wg   1   0         49            0    479.7kb        479.7kb
..............
...........
.........
green  open   .monitoring-es-7-mb-2021.12.10  rWeEyRgXQ6WyaejYtczZyw   1   0     914506            0    476.3mb        476.3mb
green  open   .kibana_task_manager_7.15.1_001 m714WabpTvWQxel_fza32w   1   0         18        20334      2.9mb          2.9mb
green  open   .kibana_7.15.1_001              yzDp69dxQla3hNFc_QqOdw   1   0        183          122     10.5mb         10.5mb
green  open   .kibana-event-log-7.15.1-000002 6sNxfBtjQ8GTSpV-q4VSCQ   1   0          0            0       208b           208b
green  open   .kibana-event-log-7.15.1-000001 Ij00mOLCT-Cg3hF255AKLA   1   0         18            0       61kb           61kb
green  open   .fleet-policies-7               JRnuIPXuTtyQMZgLeQeI3A   1   0          1            0      5.7kb          5.7kb
green  open   .async-search                   noD20NV6SwiqPXXo0xSjHw   1   0          0            0       259b           259b
green  open   .apm-custom-link                UvgEVYqLRl-jlj2P7qw2FA   1   0          0            0       261b           261b
green  open   .apm-agent-configuration        6H5VY9ouT_696OwqfOt6gw   1   0          0            0       283b           283b

I have sorted this output also by index name, so it is easier to follow. So there are 4 ".kibana*" indexes present (I pasted all of these there).

But, when I search like this, then I get 5 ".kibana*" indices.

GET _cat/indices/.ki*?v&s=index:desc

health status index                           uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .kibana_task_manager_7.15.1_001 m714WabpTvWQxel_fza32w   1   0         18        20553      2.9mb          2.9mb
green  open   .kibana_security_session_1      9lyvAGzjQ1KG1qkpsCjlOg   1   0         19            0     19.6kb         19.6kb
green  open   .kibana_7.15.1_001              yzDp69dxQla3hNFc_QqOdw   1   0        183          127     10.5mb         10.5mb
green  open   .kibana-event-log-7.15.1-000002 6sNxfBtjQ8GTSpV-q4VSCQ   1   0          0            0       208b           208b
green  open   .kibana-event-log-7.15.1-000001 Ij00mOLCT-Cg3hF255AKLA   1   0         18            0       61kb           61kb

This one indice ".kibana_security_session_1" is not present from my first command "GET _cat/indices/*?v&s=index:desc"

Why is that..?

Also, there are many more indices like that. So it is not the only one.

Regards
Raul

[raulk89 (Raul Kaubi)]

Also, when searching with phrase "ilm-history*", I get 1 index.

GET _cat/indices/ilm-history*?v&s=index:desc
health status index                uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   ilm-history-3-000004 yHULkcqlQk6i-OyRZq4mlg   1   0          0            0       261b           261b

But actually there are 4 more (so 5 in total)

When I search with exact match, then I can see those as well

GET _cat/indices/ilm-history-2-000016?v&s=index:desc
health status index                uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   ilm-history-2-000016 vPGJAaOCQ4iK6dxjuSzAug   1   0          0            0       208b           208b

Raul

[stephenb (Stephen Brown)]

Is there an issue or just curious

try

GET /_cat/indices/ilm*?v&s=index&expand_wildcards=all

Most the system indices will be really hidden in 8.0 so most this will go away

See Here

expand_wildcards

(Optional, string) Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as open,hidden . Valid values are:

all

Match any data stream or index, including hidden ones.

open

Match open, non-hidden indices. Also matches any non-hidden data stream.

closed

Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.

hidden

Match hidden data streams and hidden indices. Must be combined with open , closed , or both.

none

Wildcard patterns are not accepted.