Multi Index Search - Multiple Queries within the query

Elastic Stack Elasticsearch
1

Hello,

I was wondering if there was a way to do one call with multiple indexes but also have individual queries for each index?

Currently i am specifying all of my indexes that i need above the body > index:[index1, index2, etc]

Then in the query i am using lots of bools with must not field exists (if field exists then do this query), this seems to work but is getting complicated as my index list increases.

I realize i could just do separate calls for each index (with their own queries) but this way is alot faster and i also realize that these indexes should be normalized (but they are not and i have no control over that).

To sum it up i am trying to allow users to select some options and an optional search string, let the system search across all of the specified indexes for these options (if they make sense for that index - e.g. some have product fields some dont) and then bring back the match count for each index (the count part i am using aggs on the _type field).

Thanks,

1 Like
2

You could do this in one query by building a composite query that combines the query that you would wish to execute against a specific index with a term or terms query that filters only to those indices you're interested in.

As an example, here's a query that executes a search request against all indices, but targets indices index-1 and index-2 differently to the rest by using two bool queries in the should clause of a bool query. Each of the inner bool queries combines a must clause (the query to execute) with a filter or must_not clause that determines the indices to apply to.

POST http://localhost:9200/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must": [
              {
                "term": {
                  "query-field": {
                    "value": "query-term"
                  }
                }
              }
            ],
            "filter": [
              {
                "terms": {
                  "_index": [
                    "index-1",
                    "index-2"
                  ]
                }
              }
            ]
          }
        },
        {
          "bool": {
            "must": [
              {
                "term": {
                  "no-match-query-field": {
                    "value": "no-match-query-term"
                  }
                }
              }
            ],
            "must_not": [
              {
                "terms": {
                  "_index": [
                    "index-1",
                    "index-2"
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }
}
3 Likes
3

Thanks for taking the time to explain this, I will try it first thing in the morning and will report back :grinning:

4

Seems to work great. :slight_smile:

Any reason why we need to negate the fields and not promote them? Just want to understand why its working rather than "it works". In my head i would want to think " i want to match these fields to these indexes" but the way this works is "i want to match these fields to any index apart from these.

Thanks again

5

This is purely an example; you can extend the number of bool queries as should clauses to implement pretty much any arbitrary index targeting that you need to perform.

I pulled this example out of another question that was asking how to support similar functionality to indices queries now that they're deprecated in 5.x :smile:

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.