Type to search.

_index field

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

When performing queries across multiple indexes, it is sometimes desirable to add query clauses that are associated with documents of only certain indexes. The _index field allows matching on the index a document was indexed into. Its value is accessible in certain queries and aggregations, and when sorting or scripting:

JSON 
PUT index_1/_doc/1
{
  "text": "Document in index 1"
}
PUT index_2/_doc/2?refresh=true
{
  "text": "Document in index 2"
}
GET index_1,index_2/_search
{
  "query": {
    "terms": {
      "_index": ["index_1", "index_2"]
    }
  },
  "aggs": {
    "indices": {
      "terms": {
        "field": "_index",
        "size": 10
      }
    }
  },
  "sort": [
    {
      "_index": {
        "order": "asc"
      }
    }
  ],
  "script_fields": {
    "index_name": {
      "script": {
        "lang": "painless",
        "source": "doc['_index']"
      }
    }
  }
}
  1. Querying on the _index field
  2. Aggregating on the _index field
  3. Sorting on the _index field
  4. Accessing the _index field in scripts

The _index field is exposed virtually — it is not added to the Lucene index as a real field. This means that you can use the _index field in a term or terms query (or any query that is rewritten to a term query, such as the match, query_string or simple_query_string query), as well as prefix and wildcard queries. However, it does not support regexp and fuzzy queries.

Queries on the _index field accept index aliases in addition to concrete index names.

Note

When specifying a remote index name such as cluster_1:index_3, the query must contain the separator character :. For example, a wildcard query on cluster_*:index_3 would match documents from the remote index. However, a query on cluster*index_1 is only matched against local indices, since no separator is present. This behavior aligns with the usual resolution rules for remote index names.