Searching all indexes without searching _river index

Elastic Stack Elasticsearch
1

Hi all,

Newbie user to ES here!

I'm loading in some data into ES using rivers so i'm getting an _river
index created along with the others (one per river).

When i do a search involving sorting (e.g. i have a count field in all my
docs), i get the following error:

  • failed: 1,

  • failures:
    [

    {
    - index: "_river",
    - shard: 0,
    - status: 400,
    - reason: "SearchParseException[[_river][0]:
    query[link:test],from[-1],size[-1]: Parse Failure [Failed to parse source
    [{"query":{"query_string":{"query":"link:test","lowercase_expanded_terms":true,"analyze_wildcard":false}},"sort":[{"totalCount":{"order":"desc"}}]}]]];
    nested: SearchParseException[[_river][0]:
    query[link:test],from[-1],size[-1]: Parse Failure [No mapping found for
    [totalCount] in order to sort on]]; "
    }
    ]

Is there a way to do a search over all the indexes (without explicitly
naming them) and exclude the _river index?

Thanks,

--

2

The search still completes - this failure is just a warning but i was just
wondering if there was some way to ignore that index.

On Thursday, 20 September 2012 10:52:05 UTC+1, Derry O' Sullivan wrote:

Hi all,

Newbie user to ES here!

I'm loading in some data into ES using rivers so i'm getting an _river
index created along with the others (one per river).

When i do a search involving sorting (e.g. i have a count field in all my
docs), i get the following error:

  • failed: 1,

  • failures:
    [

    {
    - index: "_river",
    - shard: 0,
    - status: 400,
    - reason: "SearchParseException[[_river][0]:
    query[link:test],from[-1],size[-1]: Parse Failure [Failed to parse source
    [{"query":{"query_string":{"query":"link:test","lowercase_expanded_terms":true,"analyze_wildcard":false}},"sort":[{"totalCount":{"order":"desc"}}]}]]];
    nested: SearchParseException[[_river][0]:
    query[link:test],from[-1],size[-1]: Parse Failure [No mapping found for
    [totalCount] in order to sort on]]; "
    }
    ]

Is there a way to do a search over all the indexes (without explicitly
naming them) and exclude the _river index?

Thanks,

--

3

I spotted that _all is not working in 0.19.9. (
0.19.9 no longer supports /_all/_status · Issue #2205 · elastic/elasticsearch · GitHub). Does _all
include _river or is it only manually created indexes?

On Thursday, 20 September 2012 10:59:10 UTC+1, Derry O' Sullivan wrote:

The search still completes - this failure is just a warning but i was just
wondering if there was some way to ignore that index.

On Thursday, 20 September 2012 10:52:05 UTC+1, Derry O' Sullivan wrote:

Hi all,

Newbie user to ES here!

I'm loading in some data into ES using rivers so i'm getting an _river
index created along with the others (one per river).

When i do a search involving sorting (e.g. i have a count field in all my
docs), i get the following error:

  • failed: 1,

  • failures:
    [

    {
    - index: "_river",
    - shard: 0,
    - status: 400,
    - reason: "SearchParseException[[_river][0]:
    query[link:test],from[-1],size[-1]: Parse Failure [Failed to parse source
    [{"query":{"query_string":{"query":"link:test","lowercase_expanded_terms":true,"analyze_wildcard":false}},"sort":[{"totalCount":{"order":"desc"}}]}]]];
    nested: SearchParseException[[_river][0]:
    query[link:test],from[-1],size[-1]: Parse Failure [No mapping found for
    [totalCount] in order to sort on]]; "
    }
    ]

Is there a way to do a search over all the indexes (without explicitly
naming them) and exclude the _river index?

Thanks,

--