# Why the index is included in a square bracket in the payload of search request?

**URL:** <https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197>\
**Category:** Kibana\
**Created:** [April 8, 2018, 8:29am UTC](https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197 "2018-04-08T08:29:07Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahrtr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahrtr/32/29551_2.png) [@ahrtr](https://discuss.elastic.co/u/ahrtr)\
**Post date:** [April 8, 2018, 8:29am UTC](https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197/1 "2018-04-08T08:29:07Z")

</div>

For example, when I search log data on the discover page, then the browser POST the following request to kibana server,

> POST /elasticsearch/\_msearch  
> {"index":["logstash\*"],"ignore\_unavailable":true,"preference":1523174909784}  
> {......}

In the above example, why the index pattern "logstash\*" is included in a square bracket? Are there any possibilities to have multiple index patterns in one search request? If not, then why put it in a square bracket? Please kindly correct me if I missed anything. Thanks.

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [April 9, 2018, 5:36pm UTC](https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197/2 "2018-04-09T17:36:51Z")

</div>

Hi,

[] are in the syntax of msearch api. Kibana doesn't let you send multiple index patterns in the same search in discover right now.

[https://www.elastic.co/guide/en/elasticsearch/reference/6.2/search-multi-search.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/search-multi-search.html)

Hope this helps.

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![ahrtr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahrtr/32/29551_2.png) [@ahrtr](https://discuss.elastic.co/u/ahrtr)\
**Post date:** [April 10, 2018, 8:46am UTC](https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197/3 "2018-04-10T08:46:27Z")

</div>

Thanks for the feedback.

You know, square bracket means an array of items. So it doesn't make sense to get the index name included in square bracket if kibana doesn't let user to send multiple index patterns in the same search.

The index names are NOT included in square bracket in the page you provided,  
[https://www.elastic.co/guide/en/elasticsearch/reference/6.2/search-multi-search.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/search-multi-search.html)

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [April 10, 2018, 4:28pm UTC](https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197/4 "2018-04-10T16:28:31Z")

</div>

You can actually search `multiple indices` in Discover, but only a single `index pattern` (which accesses multiple indices).

The common case is something like `logstash-*` which searches multiple time-based indices.

You _should_ also be able to create index patterns like `logstash1-*, logstash2-*` (comma-separated list of index names). But there's a bug in some releases of Kibana which doesn't let you create this index pattern. But Discover is probably using that [] syntax for that reason.

---

<div class="post-metadata">

**Author:** ![ahrtr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahrtr/32/29551_2.png) [@ahrtr](https://discuss.elastic.co/u/ahrtr)\
**Post date:** [April 10, 2018, 11:44pm UTC](https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197/5 "2018-04-10T23:44:34Z")

</div>

@LeeDr

Thanks for the explanation, which makes sense.

So it's safe to assume that there will be always only one index-pattern in each search request.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2018, 11:44pm UTC](https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197/6 "2018-05-08T23:44:39Z")

</div>

Closed on May 8, 2018, 11:44pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.