Elasticsearch: How do I find the same field name across multiple indices?-CodePudding

I need to find out which of my ES indices contain a filed named "book_id". I'm trying to use this query:

GET */_search
{
 "query": {
    "term": {
      "field_name": {
        "value": "book_id",
        "boost": 1.0
      }
    }
  }
}

as well as the same query run against /_mapping.

What I am hoping to retrieve is a list of indices, in which the documents contain the "book_id" field.

What is the proper way of doing this?

CodePudding user response：

You can aggregate on the _index field:

{
  "query": {...},
  "aggs": {
    "by_index": {
      "terms": {
        "field": "_index",
        "size": 100
      }
    }
  }
}

This will return the amount of documents matching your query grouped by index. You might need to change the size parameter or use a composite aggregation when you have a lot of indices.

CodePudding user response：

You can search on all indices and aggregate over the _index meta field to get your desired result.

Here is the complete elastic query to do that -

POST /_search
{
  "size": 0, 
  "query": {
    "bool": {
      "filter": {
        "exists": {
          "field": "book_id"
        }
      }
    }
  },
  "aggs": {
    "indexes": {
      "terms": {
        "field": "_index",
        "size": 100
      }
    }
  }
}