How to fetch data through multiple indexes

Elastic Stack Elasticsearch
1

Problem:
I need to fetch data through multiple indexes.

Use Case:
Currently I have an index "something-*", and it stores data monthly (for example something-2026-05, something-2026-04). Now I need to fetch data for last 7 days, and if this things needs to executed in starting of a month (for example first 6 days of a month), Then how to achieve this. Please help

2

Hello @Suiiinaldo

Welcome to the Community!!

So if i understand your query correctly you have a index pattern of something-* this will have say last 6 months data available as you have monthly indices...now to fetch data for last 7 days it is simple because you use now - 7 days ...you query is how to extract the data for may month for first 6 days ? or it is first 6 days of all months or only current month ?

Thanks!!

3

No, My query is for example I write a script which fetches data for last 7 days, but since the data is distributed among different indexes on monthly basis and if I am executing the script in the first 4 days of a month, then it needs to fetch data from 2 indexes (that is for 4 days from one index and 3 days from previous index), so is there any thing which can help me fetch data from multiple indexes without querying twice.

4

I would recommend searching all matching indices using an index pattern, e.g. "something-*". In old versions of Elasticsearch this used to be rather expensive, so narrowing down the number of indoces that could hold relevant data was often required for optimal performance. The internal process of eliminating indices that does not hold relevant data within Elasticsearch was however dramatically improved a long time ago, so querying a large number of indices where only a few are expected to hold relevant data is generally not an issue any longer.