# Query multiple indexes

**URL:** <https://discuss.elastic.co/t/query-multiple-indexes/240396>\
**Category:** Elasticsearch\
**Created:** [July 8, 2020, 4:07pm UTC](https://discuss.elastic.co/t/query-multiple-indexes/240396 "2020-07-08T16:07:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sai\_16](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sai\_16](https://discuss.elastic.co/u/sai_16)\
**Post date:** [July 8, 2020, 4:07pm UTC](https://discuss.elastic.co/t/query-multiple-indexes/240396/1 "2020-07-08T16:07:55Z")

</div>

I need to perform this,how is it possible?

I have index1 - with cpu,mem,hostname details.  
index-2 with location details.  
Now i need to fetch cpu,mem information of hostnames starting with host\* and location is bgl.How can this be done?

I tried as below but didnt work.

```auto
{ "size": 10000, "_source" : ["@timestamp","beat.name", "system.memory.used.pct","system.cpu.total.norm.pct"], "aggs": { "4": { "date_histogram": { "field": "@timestamp", "interval": "1h", "time_zone": "US/Eastern", "min_doc_count": 1 }, "aggs": { "Avg CPU": { "avg": { "field": "system.cpu.total.norm.pct" } }, "Avg Memory": { "avg": { "field": "system.memory.used.pct" } } } } }, "query": { "bool": { "must": [{"range" : {"@timestamp" : { "gte": "now-4h","lte": "now"}}}], "filter": [{ "bool": { "should": [ { "query_string": { "query": "index1-*.beat.name: host* AND index2-*.city.keyword:BANGALORE","analyze_wildcard": true, "default_field": "*" } }] } } ] } } }

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 8, 2020, 9:42pm UTC](https://discuss.elastic.co/t/query-multiple-indexes/240396/2 "2020-07-08T21:42:38Z")

</div>

That would be a join, which Elasticsearch cannot do.  
You'd need to add the location field to the metrics.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 5, 2020, 9:42pm UTC](https://discuss.elastic.co/t/query-multiple-indexes/240396/3 "2020-08-05T21:42:39Z")

</div>

Closed on August 5, 2020, 9:42pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.