# Use of Filter on multiple indices

**URL:** <https://discuss.elastic.co/t/use-of-filter-on-multiple-indices/124933>\
**Category:** Elasticsearch\
**Created:** [March 21, 2018, 8:35am UTC](https://discuss.elastic.co/t/use-of-filter-on-multiple-indices/124933 "2018-03-21T08:35:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kurzer\_Patrick](https://avatars.discourse-cdn.com/v4/letter/k/9de053/32.png) [@Kurzer\_Patrick](https://discuss.elastic.co/u/Kurzer_Patrick)\
**Post date:** [March 21, 2018, 8:35am UTC](https://discuss.elastic.co/t/use-of-filter-on-multiple-indices/124933/1 "2018-03-21T08:35:01Z")

</div>

Hi,

I try to query two different indices with a filter on a specific field.

Lets say I have an `index1` and an `index2` where both of the indices have a field named `name` and just `index2` have an extra field `code`.

Lets say I put 3 documents:

```
PUT index1/index1/1
{
    "name" : "kimchy"
}
PUT index2/index2/1
 {
     "name" : "kimchy",
     "code" : "secret"
 }
PUT index2/index2/2
 {
     "name" : "kimchy",
     "code" : "notSecret"
 }

```

I would like to find all documents from `index1` where `name = kimchy` and from `index2` where `name = kimchy and code = secret`.

Means document `index1/1` and `index2/1` should be in the result.

I tried to use `filter` to filter the `code` field. But unfortunately I just get document `index2/2` because `index1` does not have code field and does not match.

```
GET index1,index2/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "name": "kimchy"
          }
        }
      ],
      "filter": {
        "term": {
          "code": "secret"
        }
      }
    }
  }
}

```

Is there a way to achive that?

If you need any additional info, please let me know.

Thanks!

---

<div class="post-metadata">

**Author:** ![Kurzer\_Patrick](https://avatars.discourse-cdn.com/v4/letter/k/9de053/32.png) [@Kurzer\_Patrick](https://discuss.elastic.co/u/Kurzer_Patrick)\
**Post date:** [March 21, 2018, 9:13am UTC](https://discuss.elastic.co/t/use-of-filter-on-multiple-indices/124933/2 "2018-03-21T09:13:38Z")

</div>

I think I found a solution by using should and must\_not:

```
GET index1,index2/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "name": "fendels"
          }
        }
      ],
      "filter": {
        "bool": {
          "should": [
            {
              "term": {
                "code": "secret"
              }
            },
            {
              "bool": {
                "must_not": {
                  "exists": {
                    "field": "code"
                  }
                }
              }
            }
          ]
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 21, 2018, 9:29am UTC](https://discuss.elastic.co/t/use-of-filter-on-multiple-indices/124933/3 "2018-03-21T09:29:19Z")

</div>

I think your solution does not exactly answer what you described.

> I would like to find all documents from `index1` where `name = kimchy` and from `index2` where `name = kimchy and code = secret`.

Here is my proposal:

```auto
GET index1,index2/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must": [
              {
                "match": {
                  "name": "kimchy"
                }
              }
            ], 
            "filter": [
              {
                "term": {
                  "_index": "index1"
                }
              }
            ]
          }
        },
        {
          "bool": {
            "must": [
              {
                "match": {
                  "name": "kimchy"
                }
              }
            ], 
            "filter": [
              {
                "term": {
                  "_index": "index2"
                }
              },
              {
                "term": {
                  "code": "secret"
                }
              }
            ]
          }
        }
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Kurzer\_Patrick](https://avatars.discourse-cdn.com/v4/letter/k/9de053/32.png) [@Kurzer\_Patrick](https://discuss.elastic.co/u/Kurzer_Patrick)\
**Post date:** [March 21, 2018, 10:02am UTC](https://discuss.elastic.co/t/use-of-filter-on-multiple-indices/124933/4 "2018-03-21T10:02:50Z")

</div>

Thanks for your proposal. The result is the same but the query is much better structured and describes also my question.

I will go further with your solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2018, 10:03am UTC](https://discuss.elastic.co/t/use-of-filter-on-multiple-indices/124933/5 "2018-04-18T10:03:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.