Index patterns

Elasticsearch SQL supports two types of patterns for matching multiple indices or tables:

The Elasticsearch notation for enumerating, including or excluding multi-target syntax is supported as long as it is quoted or escaped as a table identifier.

For example:

SHOW TABLES "*,-l*";

 catalog       |     name      | type     |     kind
---------------+---------------+----------+---------------
javaRestTest      |emp            |TABLE     |INDEX
javaRestTest      |employees      |VIEW      |ALIAS

Notice the pattern is surrounded by double quotes ". It enumerated * meaning all indices however it excludes (due to -) all indices that start with l. This notation is very convenient and powerful as it allows both inclusion and exclusion, depending on the target naming convention.

The same kind of patterns can also be used to query multiple indices or tables.

For example:

SELECT emp_no FROM "e*p" LIMIT 1;

    emp_no
---------------
10001

Stack Preview The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Preview Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. To run a cross-cluster search, specify a cluster name using the <remote_cluster>:<target> syntax, where <remote_cluster> maps to a SQL catalog (cluster) and <target> to a table (index or data stream). The <remote_cluster> supports wildcards (*) and <target> can be an index pattern.

For example:

SELECT emp_no FROM "my*cluster:*emp" LIMIT 1;

    emp_no
---------------
10001

The common LIKE statement (including escaping if needed) to match a wildcard pattern, based on one _ or multiple % characters.

Using SHOW TABLES command again:

SHOW TABLES LIKE 'emp%';

 catalog       |     name      | type     |     kind
---------------+---------------+----------+---------------
javaRestTest      |emp            |TABLE     |INDEX
javaRestTest      |employees      |VIEW      |ALIAS

The pattern matches all tables that start with emp.

This command supports escaping as well, for example:

SHOW TABLES LIKE 'emp!%' ESCAPE '!';

 catalog       |     name      |     type      |     kind
---------------+---------------+---------------+---------------

Notice how now emp% does not match any tables because %, which means match zero or more characters, has been escaped by ! and thus becomes an regular char. And since there is no table named emp%, an empty table is returned.

In a nutshell, the differences between the two type of patterns are:

Which one to use, is up to you however try to stick to the same one across your queries for consistency.