_index field

When performing queries across multiple indexes, it is sometimes desirable to add query clauses that are associated with documents of only certain indexes. The _index field allows matching on the index a document was indexed into. Its value is accessible in certain queries and aggregations, and when sorting or scripting:

  1. PUT index_1/_doc/1
  2. {
  3.   "text": "Document in index 1"
  4. }
  6. PUT index_2/_doc/2?refresh=true
  7. {
  8.   "text": "Document in index 2"
  9. }
  11. GET index_1,index_2/_search
  12. {
  13.   "query": {
  14.     "terms": {
  15.       "_index": ["index_1", "index_2"] 
  16.     }
  17.   },
  18.   "aggs": {
  19.     "indices": {
  20.       "terms": {
  21.         "field": "_index", 
  22.         "size": 10
  23.       }
  24.     }
  25.   },
  26.   "sort": [
  27.     {
  28.       "_index": { 
  29.         "order": "asc"
  30.       }
  31.     }
  32.   ],
  33.   "script_fields": {
  34.     "index_name": {
  35.       "script": {
  36.         "lang": "painless",
  37.         "source": "doc['_index']" 
  38.       }
  39.     }
  40.   }
  41. }

Querying on the _index field

Aggregating on the _index field

Sorting on the _index field

Accessing the _index field in scripts

The _index field is exposed virtually — it is not added to the Lucene index as a real field. This means that you can use the _index field in a term or terms query (or any query that is rewritten to a term query, such as the match, query_string or simple_query_string query), as well as prefix and wildcard queries. However, it does not support regexp and fuzzy queries.

Queries on the _index field accept index aliases in addition to concrete index names.

When specifying a remote index name such as cluster_1:index_3, the query must contain the separator character :. For example, a wildcard query on cluster_*:index_3 would match documents from the remote index. However, a query on cluster*index_1 is only matched against local indices, since no separator is present. This behavior aligns with the usual resolution rules for remote index names.