Search across multiple indices

Your map might contain multiple Elasticsearch indices. This can occur when your map contains two or more layers with Elasticsearch sources from different indices. This can also occur with a single layer with an Elasticsearch source and a Term join.

Searching across multiple indices might sometimes result in empty layers. The most common cause for empty layers are searches for a field that exists in one index, but does not exist in other indices.

One strategy for eliminating unintentional empty layers from a cross index search is to disable global search for a layer.

Add _index to your search to include documents from indices that do not contain a search field.

For example, suppose you have a vector layer showing the kibana_sample_data_logs documents and another vector layer with kibana_sample_data_flights documents. (See adding sample data to install the kibana_sample_data_logs and kibana_sample_data_flights indices.)

If you query for

machine.os.keyword : "osx"

the kibana_sample_data_flights layer is empty because the index kibana_sample_data_flights does not contain the field machine.os.keyword and no documents match the query.

If you instead query for

machine.os.keyword : "osx" or _index : "kibana_sample_data_flights"

the kibana_sample_data_flights layer includes data.