Why the index is included in a square bracket in the payload of search request?

[ahrtr]

For example, when I search log data on the discover page, then the browser POST the following request to kibana server,

POST /elasticsearch/_msearch
{"index":["logstash*"],"ignore_unavailable":true,"preference":1523174909784}
{......}

In the above example, why the index pattern "logstash*" is included in a square bracket? Are there any possibilities to have multiple index patterns in one search request? If not, then why put it in a square bracket? Please kindly correct me if I missed anything. Thanks.

[bhavyarm]

Hi,

[ ] are in the syntax of msearch api. Kibana doesn't let you send multiple index patterns in the same search in discover right now.

https://www.elastic.co/guide/en/elasticsearch/reference/6.2/search-multi-search.html

Hope this helps.

Thanks,
Bhavya

[ahrtr]

Thanks for the feedback.

You know, square bracket means an array of items. So it doesn't make sense to get the index name included in square bracket if kibana doesn't let user to send multiple index patterns in the same search.

The index names are NOT included in square bracket in the page you provided,
https://www.elastic.co/guide/en/elasticsearch/reference/6.2/search-multi-search.html

[LeeDr (Lee Drengenberg)]

You can actually search multiple indices in Discover, but only a single index pattern (which accesses multiple indices).

The common case is something like logstash-* which searches multiple time-based indices.

You should also be able to create index patterns like logstash1-*, logstash2-* (comma-separated list of index names). But there's a bug in some releases of Kibana which doesn't let you create this index pattern. But Discover is probably using that [ ] syntax for that reason.

[ahrtr]

@LeeDr

Thanks for the explanation, which makes sense.

So it's safe to assume that there will be always only one index-pattern in each search request.