# Multiple index search
**URL:** https://discuss.elastic.co/t/multiple-index-search/329180
**Category:** SIEM
**Created:** [April 3, 2023, 8:48am UTC](https://discuss.elastic.co/t/multiple-index-search/329180 "2023-04-03T08:48:29Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Phoenix1](https://discuss.elastic.co/u/Phoenix1)
#### Post date: [April 3, 2023, 8:48am UTC](https://discuss.elastic.co/t/multiple-index-search/329180/1 "2023-04-03T08:48:29Z")
How to search logs in multiple index, within discover it does not gives option to select multiple indexes in drop down option.
---
### Author:  [@stephmilovic](https://discuss.elastic.co/u/stephmilovic)
#### Post date: [April 3, 2023, 2:13pm UTC](https://discuss.elastic.co/t/multiple-index-search/329180/2 "2023-04-03T14:13:46Z")
Hi @Phoenix1. Have you checked out the [documentation on Kibana data views](https://www.elastic.co/guide/en/kibana/master/data-views.html)? I suggest creating a data view with a wildcard index patten:
> - To match multiple sources, use a wildcard (\*). `filebeat-*` matches `filebeat-apache-a`, `filebeat-apache-b`, and so on.
After creating your data view, it will appear in the different data view selectors across the app including in Discover and the Security Solution:
Please let us know if this solves your issue.
Best,
Steph
---
### Author:  [@Phoenix1](https://discuss.elastic.co/u/Phoenix1)
#### Post date: [April 3, 2023, 2:45pm UTC](https://discuss.elastic.co/t/multiple-index-search/329180/3 "2023-04-03T14:45:51Z")
Hi Steph,
Thanks for your reposne, it seems you are suggesting how to access different logsource types. instead, just see your screen shot where we have to select one or the other index (under drop down)in discover. Let say we have Index1, Index2, Index3 indexes. My question is how to search event/logs in all three in one go ?
I searched and possible answer could be Index pattern, let me know what you think i still needs to check on this if it is the solution.
---
### Author:  [@Wave](https://discuss.elastic.co/u/Wave)
#### Post date: [April 3, 2023, 2:55pm UTC](https://discuss.elastic.co/t/multiple-index-search/329180/4 "2023-04-03T14:55:30Z")
Just wanted to add that data views are the new name for what index patterns did previously. @Phoenix1 Think the suggested provided by @stephmilovic should work just fine if I'm understanding you right.
---
### Author:  [@Phoenix1](https://discuss.elastic.co/u/Phoenix1)
#### Post date: [April 3, 2023, 3:06pm UTC](https://discuss.elastic.co/t/multiple-index-search/329180/5 "2023-04-03T15:06:56Z")
ok, Thanks @stephmilovic and @Wave. Will get this check and inform your guys.
Thanks for quick support.
---
### Author:  [@stephmilovic](https://discuss.elastic.co/u/stephmilovic)
#### Post date: [April 3, 2023, 3:43pm UTC](https://discuss.elastic.co/t/multiple-index-search/329180/6 "2023-04-03T15:43:28Z")
> Let say we have Index1, Index2, Index3 indexes. My question is how to search event/logs in all three in one go ?
First let's clean up the example, index names must be lower case. So adjusting the example to be index1, index2, index3
You can create a data view with a wildcard. `index*` will retrieve the 3 indices you list above. You could also create a data view and explicitly name each index in a comma separated list in the index pattern like `index1,index2,index3`. We generally recommend using a wildcard index pattern so that all future indices matching this naming pattern will be picked up by the data view. Here is what that looks like in the Create data view UI:
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2023, 3:43pm UTC](https://discuss.elastic.co/t/multiple-index-search/329180/7 "2023-05-01T15:43:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.