# Two indices on my document

**URL:** <https://discuss.elastic.co/t/two-indices-on-my-document/8158>\
**Category:** Elasticsearch\
**Created:** [June 19, 2012, 8:28pm UTC](https://discuss.elastic.co/t/two-indices-on-my-document/8158 "2012-06-19T20:28:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Praveen\_Kariyanahall](https://avatars.discourse-cdn.com/v4/letter/p/4491bb/32.png) [@Praveen\_Kariyanahall](https://discuss.elastic.co/u/Praveen_Kariyanahall)\
**Post date:** [June 19, 2012, 8:28pm UTC](https://discuss.elastic.co/t/two-indices-on-my-document/8158/1 "2012-06-19T20:28:20Z")

</div>

Here is the problem I have.

I need to create an index on my document say by tenant name. And another  
one using say date. So if I need to lookup documents for a particular  
tenant .. I use just the first index. If I need to lookup documents for a  
particular tenant on a given date .. I use both.

Can somebody point me to man pages as to how to achieve this ? I am new to  
elastic search, if this has been answered already, please point me to that  
thread !

Thanks in Advance  
pk

---

<div class="post-metadata">

**Author:** ![andym](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@andym](https://discuss.elastic.co/u/andym)\
**Post date:** [June 19, 2012, 8:48pm UTC](https://discuss.elastic.co/t/two-indices-on-my-document/8158/2 "2012-06-19T20:48:45Z")

</div>

Praveen,

For what you're asking sounds like you need just one ES index (unlike  
traditional SQL you do not need explicitly specify multiple indexes  
per column to speed up lookup, as the fields gets by indexed by  
default in ES)

Given that you need one index, follow the instructions in "Getting  
Started" section below

> **[GitHub - elastic/elasticsearch: Free and Open, Distributed, RESTful Search...](https://github.com/elastic/elasticsearch)**
>
> Free and Open, Distributed, RESTful Search Engine. Contribute to elastic/elasticsearch development by creating an account on GitHub.

In the instructions substitute "user" for "tenant\_name" and  
"post\_date" for "movein\_date"  
The "Getting Started" shows how to search per one field per query, if  
you want to search per more then one field per query, you need to  
combine your filters with AND or OR, instructions are here:

> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.

Having 2 different indices is certainly possibly, but it usually used  
when different data is stored in the disctinct indices

On Jun 19, 1:28 pm, Praveen Kariyanahalli  
[praveen.kariyanaha...@gmail.com](mailto:praveen.kariyanaha...@gmail.com) wrote:

> Here is the problem I have.
> 
> I need to create an index on my document say by tenant name. And another  
> one using say date. So if I need to lookup documents for a particular  
> tenant .. I use just the first index. If I need to lookup documents for a  
> particular tenant on a given date .. I use both.
> 
> Can somebody point me to man pages as to how to achieve this ? I am new to  
> Elasticsearch, if this has been answered already, please point me to that  
> thread !
> 
> Thanks in Advance  
> pk

---

<div class="post-metadata">

**Author:** ![Praveen\_Kariyanahall](https://avatars.discourse-cdn.com/v4/letter/p/4491bb/32.png) [@Praveen\_Kariyanahall](https://discuss.elastic.co/u/Praveen_Kariyanahall)\
**Post date:** [June 19, 2012, 8:59pm UTC](https://discuss.elastic.co/t/two-indices-on-my-document/8158/3 "2012-06-19T20:59:02Z")

</div>

Hi Andy

Thanks for your quick response. I need date as an extra index because, if I  
need to delete an entire day's indexed data (say 6 month old data), it is  
just a single crontab entry doing an XDELETE on that index. In fact this  
is advised in the Elasticsearch tutorials, better way (more efficient  
way) than using TTL. That justifies having date as one index.

I need tenant name as another index for security purposes. I dont want to  
be querying for \_all and then filtering on the tenant.

Is there a place where ES multiple indexing is explained?

Thanks in Advance  
-pk

On Tuesday, June 19, 2012 1:48:45 PM UTC-7, andym wrote:

> Praveen,
> 
> For what you're asking sounds like you need just one ES index (unlike  
> traditional SQL you do not need explicitly specify multiple indexes  
> per column to speed up lookup, as the fields gets by indexed by  
> default in ES)
> 
> Given that you need one index, follow the instructions in "Getting  
> Started" section below  
> [GitHub - elastic/elasticsearch: Free and Open, Distributed, RESTful Search Engine](https://github.com/elasticsearch/elasticsearch)
> 
> In the instructions substitute "user" for "tenant\_name" and  
> "post\_date" for "movein\_date"  
> The "Getting Started" shows how to search per one field per query, if  
> you want to search per more then one field per query, you need to  
> combine your filters with AND or OR, instructions are here:  
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/bool-query.html)
> 
> Having 2 different indices is certainly possibly, but it usually used  
> when different data is stored in the disctinct indices
> 
> On Jun 19, 1:28 pm, Praveen Kariyanahalli  
> [praveen.kariyanaha...@gmail.com](mailto:praveen.kariyanaha...@gmail.com) wrote:
> 
> > Here is the problem I have.
> > 
> > I need to create an index on my document say by tenant name. And another  
> > one using say date. So if I need to lookup documents for a particular  
> > tenant .. I use just the first index. If I need to lookup documents for  
> > a  
> > particular tenant on a given date .. I use both.
> > 
> > Can somebody point me to man pages as to how to achieve this ? I am new  
> > to  
> > Elasticsearch, if this has been answered already, please point me to  
> > that  
> > thread !
> > 
> > Thanks in Advance  
> > pk

---

<div class="post-metadata">

**Author:** ![andym](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@andym](https://discuss.elastic.co/u/andym)\
**Post date:** [June 19, 2012, 9:39pm UTC](https://discuss.elastic.co/t/two-indices-on-my-document/8158/4 "2012-06-19T21:39:58Z")

</div>

Hi Praveen,

Using multiple indicies on the same server is no different then single  
index, just prepand all your queries with index name (e.g. "index1/  
search")

However if you want ES to do a cross-index SQL-like "join" for you on  
tenant\_id (assuming you want to have data structure like below), I am  
not aware of such functionality -- you'd have to do "join" yourself.

index\_master  
{  
tenant\_id  
tenant\_name  
}

index\_month1  
{  
tenant\_id  
movein\_date  
tenant\_data  
}

It's better is store your data in the form that will be to reflective  
of your queries and avoid "join" (which might require data  
duplication), which would mean adding tenant\_name into index\_month1.  
As to retrieving only the fields that are needed, you can specify the  
fields that you want and not retrieve all the fields during your  
query:

> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.

On Jun 19, 1:59 pm, Praveen Kariyanahalli  
[praveen.kariyanaha...@gmail.com](mailto:praveen.kariyanaha...@gmail.com) wrote:

> Hi Andy
> 
> Thanks for your quick response. I need date as an extra index because, if I  
> need to delete an entire day's indexed data (say 6 month old data), it is  
> just a single crontab entry doing an XDELETE on that index. In fact this  
> is advised in the Elasticsearch tutorials, better way (more efficient  
> way) than using TTL. That justifies having date as one index.
> 
> I need tenant name as another index for security purposes. I dont want to  
> be querying for \_all and then filtering on the tenant.
> 
> Is there a place where ES multiple indexing is explained?
> 
> Thanks in Advance  
> -pk
> 
> On Tuesday, June 19, 2012 1:48:45 PM UTC-7, andym wrote:
> 
> > Praveen,
> 
> > For what you're asking sounds like you need just one ES index (unlike  
> > traditional SQL you do not need explicitly specify multiple indexes  
> > per column to speed up lookup, as the fields gets by indexed by  
> > default in ES)
> 
> > Given that you need one index, follow the instructions in "Getting  
> > Started" section below  
> > [GitHub - elastic/elasticsearch: Free and Open, Distributed, RESTful Search Engine](https://github.com/elasticsearch/elasticsearch)
> 
> > In the instructions substitute "user" for "tenant\_name" and  
> > "post\_date" for "movein\_date"  
> > The "Getting Started" shows how to search per one field per query, if  
> > you want to search per more then one field per query, you need to  
> > combine your filters with AND or OR, instructions are here:  
> > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/bool-query.html)
> 
> > Having 2 different indices is certainly possibly, but it usually used  
> > when different data is stored in the disctinct indices
> 
> > On Jun 19, 1:28 pm, Praveen Kariyanahalli  
> > [praveen.kariyanaha...@gmail.com](mailto:praveen.kariyanaha...@gmail.com) wrote:
> > 
> > > Here is the problem I have.
> 
> > > I need to create an index on my document say by tenant name. And another  
> > > one using say date. So if I need to lookup documents for a particular  
> > > tenant .. I use just the first index. If I need to lookup documents for  
> > > a  
> > > particular tenant on a given date .. I use both.
> 
> > > Can somebody point me to man pages as to how to achieve this ? I am new  
> > > to  
> > > Elasticsearch, if this has been answered already, please point me to  
> > > that  
> > > thread !
> 
> > > Thanks in Advance  
> > > pk

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 3:23am UTC](https://discuss.elastic.co/t/two-indices-on-my-document/8158/5 "2017-07-06T03:23:22Z")

</div>


