Elasticsearch List Indices Using Boolean Query

Question

I have elastic cluster with hundreds of indices. Is there any way to list (search) indices using boolean query? e.g.

( index.alias:*read_index* AND doc.count:<1000 ) OR ( index.name* ) OR (index.size:<2gb) OR (index.replica:>2)

I need to filter out required indices from the list of hundreds of indices.

Kindly suggest.

Answer 1

Using plain elasticsearch bool queries :), just store the JSON format cat output into an index, then make the queries you need, automatize the collection with a cronjob to gather this every X time, my python script looks like this:

# install dependencies: pip install requests
import requests
import json

ES_URL = "http://localhost:9200"

res = requests.get("{}{}".format(ES_URL, "/_cat/indices"),
                   params={"format": "json", "bytes": "m"})

for index_info in res.json():
    index_url = "{}/{}/{}/{}".format(
        ES_URL, "cat_to_index", "doc", index_info["index"]
    )

    requests.post(
        index_url,
        data=json.dumps(index_info),
        headers={'Content-type': 'application/json'}
    )

# ready to query http://localhost:9200/cat_to_index/_search
# ready to keep up-to-date with a cronjob, as the index name is the ID new values will be overwritten.

hope it helps.