ElasticSearch: How to search for a value in any field, across all types, in one or more indices?
Either the query_string
query or the match
query would be what you're looking for.
query_string
will use the special _all
field if none is specified in default_field
, so that would work out well.
curl -XPOST 'localhost:9200/_search?pretty' -d '{ "query": { "query_string": { "query": "abc" } }}'
And with match
you can just specify the _all
as well.
curl -XPOST 'localhost:9200/_search?pretty' -d '{ "query": { "match": { "_all": "abc" } }}'
Note that with query_string
you may use wildcards, which you can't with match
UPDATE:
As the _all
field was deprecated in 6.0, the solution is now to implement a custom all field
An alternative to the now deprecated _all field is the multi match query
GET /_search{ "query": { "multi_match" : { "query": "Will Smith", "fields": [ "important_field^5", "less_important^2", "title", "*_name" ] } }}
Note wildcards in the field names are supported as well as boosting a fields importance with the ^# syntax
As of version 7.3:If no fields are provided, the multi_match query defaults to the index.query.default_field index settings, which in turn defaults to *. * extracts all fields in the mapping that are eligible to term queries and filters the metadata fields. All extracted fields are then combined to build a query.
Another alternative is the Query string query
GET /_search{ "query": { "query_string" : { "query" : "(new york city) OR (big apple)", "default_field" : "content" } }}
default_field(Optional, string) Default field you wish to search if no field is provided in the query string.
Defaults to the index.query.default_field index setting, which has a default value of *.
I think you can use _all for this purpose
Try this
$ curl -XPOST 'localhost:9200/_search?pretty' -d '{ "query": { "match": { "_all": "abc" } }}'
You could also use query_string
as it searches against _all
by default.