Query on index-pattern gets more results than expected

Elastic Stack Elasticsearch
1

Hi all,
I'm using Elasticsearch 6.5.0.
I created 3 index patterns with Kibana. They are like bank, bank* and bank2.
I'd like to search by API if the index bank is available and query ES in this way:

GET /.kibana/_search

{
"_source": [
    "index-pattern.title",
    "namespace",
    "type",
    "title"
],
"query": {
    "bool": {
        "filter": [
            {
                "bool": {
                    "must": [
                        {
                            "term": {
                                "type": "index-pattern"
                            }
                        },
                        {
                            "term": {
                                "index-pattern.title": {
                                    "value": "bank"
                                }
                            }
                        }
                    ],
                    "must_not": [
                        {
                            "exists": {
                                "field": "namespace"
                            }
                        }
                    ]
                }
            }
        ]
    }
}
}

I supposed to get an "hits" array only 1 "index-pattern": the one with title "bank".
But I got "hits" with 2 index-pattern: one with title "bank" and the second with "bank*".
Like it:

{
"took": 1,
"timed_out": false,
"_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
},
"hits": {
    "total": 2,
    "max_score": 0,
    "hits": [
        {
            "_index": ".kibana",
            "_type": "doc",
            "_id": "index-pattern:111111",
            "_version": 1,
            "_score": 0,
            "_source": {
                "index-pattern": {
                    "title": "bank*"
                },
                "type": "index-pattern"
            }
        },
        {
            "_index": ".kibana",
            "_type": "doc",
            "_id": "index-pattern:22222",
            "_version": 2,
            "_score": 0,
            "_source": {
                "index-pattern": {
                    "title": "bank"
                },
                "type": "index-pattern"
            }
        }
    ]
}

}

How could I define a query to get only "bank"?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.