# Search for a field across multiple indices **URL:** \ **Category:** Elasticsearch\ **Created:** [October 8, 2021, 7:31pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274 "2021-10-08T19:31:42Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [October 8, 2021, 7:31pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/1 "2021-10-08T19:31:42Z")
Hi All, We have ELK 7.6.2 stack running with number of indices in place. One of the fields in the indices is called requestID which has a unique value e.g. 1-01-TV-PCVEFOW6JXMZSMEVUZBWXPWRFFMPEIG10411767701@1-21506255#10 I want to search across "all" indices for the value mentioned above and fetch complete data related to the field. All the indices have a common prefix (prod\_tv\*) Is there a way I could do this? Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 11, 2021, 12:23am UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/2 "2021-10-11T00:23:56Z")
7.6 is very old and is [EOL](https://www.elastic.co/support/eol), please upgrade ASAP. > [@zaeemmasood](#): > > Is there a way I could do this? You can use [Multi-target syntax | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.15/multi-index.html) for that. ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [October 12, 2021, 3:20am UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/3 "2021-10-12T03:20:36Z")
Thanks. Is there an example of multi target syntax being used somewhere? Is the query run through Dev tools? Also please provide link to upgrade from 7.6 to 7.15 Thank you ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 13, 2021, 1:11am UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/4 "2021-10-13T01:11:12Z")
Not directly, but just replace any instance of a single index name with something that matches that docs page. You can do it in Dev tools, yep. ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [October 14, 2021, 9:10pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/5 "2021-10-14T21:10:35Z")
Hi Mark. Sorry I am a little confused. So I have different indices running in the env. Their names are e.g `prod_tv_A1*, prod_tv_B1, prod_tv_C1, prod_tv_C2 ` How would I be able to query for a unique field named "requestID" in all the indices above using 7.15? Also if I upgrade to 7.15 from 7.6.2, do I also need to upgrade the Filebeat, Logstash and Kibana to the same version? Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 14, 2021, 9:13pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/6 "2021-10-14T21:13:49Z")
You can do that on any version of Elasticsearch. The recommendation to upgrade is a different matter to your question, but it's something you should look at. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 14, 2021, 10:08pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/7 "2021-10-14T22:08:19Z")
You can also create an alias in those indices and query using the [alias name](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/indices-aliases.html). ```auto POST _aliases { "actions": [ { "add": { "index": "prod_tv_*", "alias": "prod_tv" } } ] } ``` A query against `prod_tv` will query all the indices with this alias. ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [October 14, 2021, 10:16pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/8 "2021-10-14T22:16:11Z")
Thanks. After creating alias how do I query for a field named “requestID” and view all fields relevant to that requestID ? ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [October 19, 2021, 8:38pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/9 "2021-10-19T20:38:21Z")
Hi All, In my case the value ` 1-01-TV-PCVEFOW6JXMZSMEVUZBWXPWRFFMPEIG10411767701@1-21506255#10` appears in "two" indices one being `prod_tv_web_tmkt_access*` and the other as `prod_tv_tlite_access*` and is presented as "requestID" in one and "refID" in the second ☹ . Now if in the dev tools I put the following, it returns the occurence along with lot of unrealted info: ```auto GET /prod_tv_*/_search?q=requestId:1-01-TV-PCVEFOW6JXMZSMEVUZBWXPWRFFMPEIG10411767701@1-21506255#10 ``` Please let me know if my approach is correct and if there is a way I could add 'OR' to make it look like below. Also I need to get rid of the unrelated info: ```auto GET /prod_tv_*/_search?q=:1-01-TV-PCVEFOW6JXMZSMEVUZBWXPWRFFMPEIG10411767701@1-21506255#10 ``` Additionally I am unable to make use of the Multi-Target syntax in this scenario. Any help would be appreicated. Thanks ---
**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Post date:** [October 20, 2021, 5:28pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/10 "2021-10-20T17:28:16Z")
Found the solution. Following works: ```auto GET /_all/_search { "query": { "simple_query_string" : { "query": "1-01-TV-PCVEFOW6JXMZSMEVUZBWXPWRFFMPEIG10411767701@1-21506255#10", "fields": ["requestId", "RefID"], "default_operator": "and" } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 17, 2021, 5:29pm UTC](https://discuss.elastic.co/t/search-for-a-field-across-multiple-indices/286274/11 "2021-11-17T17:29:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.