Search with cluster wildcard returns data from non-matching indices

Elastic Stack Elasticsearch
1

Hello,

I am currently migrating from Elastic Search 7.17.8 to 8.6.2 and I am observing a very strange change of behaviour in the search API.

Using the search REST api, when the index pattern (target) contains both

  1. a cluster wildcard
  2. a pattern matching no index
    the request is returning documents from other (non-matching) indexes in Elasticsearch 8.6.2 while I am expecting no result to be returned.

Example:

GET /*:invalid/_search

In ES 7.17.8, this returns an empty result set as expected.
In ES 8.6.3, this returns document from my log stash (logstash-yyyy.mm.dd) indexes ?!

Is there a bug in ES 8 or am I missing something?

Note that I am observing the same issue through Kibana: I have some imported index patterns/Data views with such patterns and in the Discover, data from wrong indexes are shown instead of getting « no matching indices error » or no results.

Thank you in advance.

Vincent

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.