For example, when I search log data on the discover page, then the browser POST the following request to kibana server,
In the above example, why the index pattern "logstash*" is included in a square bracket? Are there any possibilities to have multiple index patterns in one search request? If not, then why put it in a square bracket? Please kindly correct me if I missed anything. Thanks.
[ ] are in the syntax of msearch api. Kibana doesn't let you send multiple index patterns in the same search in discover right now.
Hope this helps.
Thanks for the feedback.
You know, square bracket means an array of items. So it doesn't make sense to get the index name included in square bracket if kibana doesn't let user to send multiple index patterns in the same search.
The index names are NOT included in square bracket in the page you provided,
You can actually search
multiple indices in Discover, but only a single
index pattern (which accesses multiple indices).
The common case is something like
logstash-* which searches multiple time-based indices.
You should also be able to create index patterns like
logstash1-*, logstash2-* (comma-separated list of index names). But there's a bug in some releases of Kibana which doesn't let you create this index pattern. But Discover is probably using that [ ] syntax for that reason.
Thanks for the explanation, which makes sense.
So it's safe to assume that there will be always only one index-pattern in each search request.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.