You are looking at preliminary documentation for a future release. Not what you want? See the current release documentation.
Elastic Docs ›Elasticsearch Guide [master] ›REST APIs ›Index APIs
« Resolve index API Rollover API »

Resolve cluster APIedit

Resolves the specified index expressions to return information about each cluster, including the local cluster, if included.

This endpoint is useful before doing a cross-cluster search in order to determine which remote clusters should be included in a search.

You use the same index expression with this endpoint as you would for cross-cluster search. Index and cluster exclusions are also supported with this endpoint.

For each cluster in the index expression, information is returned about:

  1. whether the querying ("local") cluster is currently connected to each remote cluster in the index expression scope
  2. whether each remote cluster is configured with skip_unavailable as true or false
  3. whether there are any indices, aliases or data streams on that cluster that match the index expression
  4. whether the search is likely to have errors returned when you do the cross-cluster search (including any authorization errors if your user does not have permission to query the index)
  5. cluster version information, including the Elasticsearch server version 
GET /_resolve/cluster/my-index-*,cluster*:my-index-*

This will return information about the local cluster and all remotely configured clusters that start with the alias cluster*. Each cluster will return information about whether it has any indices, aliases or data streams that match my-index-*.

Requestedit

GET /_resolve/cluster/<index_expression>

Prerequisitesedit

  • If the Elasticsearch security features are enabled, you must have the view_index_metadata, read, or manage index privilege for the target data stream, index, or alias.

Path parametersedit

<index_expression>

(Required, string) Comma-separated name(s) or index pattern(s) of the indices, aliases, and data streams to resolve, using Multi-target syntax. Resources on remote clusters can be specified using the <cluster>:<name> syntax.

Query parametersedit

expand_wildcards

(Optional, string) Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as open,hidden. Valid values are:

all
Match any data stream or index, including hidden ones.
open
Match open, non-hidden indices. Also matches any non-hidden data stream.
closed
Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
hidden
Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
none
Wildcard patterns are not accepted.

Defaults to open.

ignore_unavailable

(Optional, Boolean) If false, the request returns an error if it targets a missing or closed index. Defaults to false.

Defaults to false.

allow_no_indices

(Optional, Boolean) If false, the request returns an error if any wildcard expression, index alias, or _all value targets only missing or closed indices. This behavior applies even if the request targets other open indices. For example, a request targeting foo*,bar* returns an error if an index starts with foo but no index starts with bar.

Defaults to true.

ignore_throttled

(Optional, Boolean) If true, concrete, expanded or aliased indices are ignored when frozen. Defaults to false.

[7.16.0] Deprecated in 7.16.0.

Advantages of using this endpoint before a cross-cluster searchedit

You may want to exclude a cluster or index from a search when:

  1. A remote cluster is not currently connected and is configured with skip_unavailable=false. Executing a cross-cluster search under those conditions will cause the entire search to fail.
  2. A cluster has no matching indices, aliases or data streams for the index expression (or your user does not have permissions to search them). For example, suppose your index expression is logs*,remote1:logs* and the remote1 cluster has no indices, aliases or data streams that match logs*. In that case, that cluster will return no results from that cluster if you include it in a cross-cluster search.
  3. The index expression (combined with any query parameters you specify) will likely cause an exception to be thrown when you do the search. In these cases, the "error" field in the _resolve/cluster response will be present. (This is also where security/permission errors will be shown.)
  4. A remote cluster is an older version that does not support the feature you want to use in your search.

Examplesedit

GET /_resolve/cluster/my-index*,clust*:my-index*

The API returns the following response:

{
  "(local)": {          
    "connected": true,
    "skip_unavailable": false,
    "matching_indices": true,
    "version": {
      "number": "8.13.0",
      "build_flavor": "default",
      "minimum_wire_compatibility_version": "7.17.0",
      "minimum_index_compatibility_version": "7.0.0"
    }
  },
  "cluster_one": {
    "connected": true,         
    "skip_unavailable": true,  
    "matching_indices": true,  
    "version": {
      "number": "8.13.0",      
      "build_flavor": "default",
      "minimum_wire_compatibility_version": "7.17.0",
      "minimum_index_compatibility_version": "7.0.0"
    }
  },
  "cluster_two": {
    "connected": true,
    "skip_unavailable": false,
    "matching_indices": true,
    "version": {
      "number": "8.13.0",
      "build_flavor": "default",
      "minimum_wire_compatibility_version": "7.17.0",
      "minimum_index_compatibility_version": "7.0.0"
    }
  }
}

Each cluster has its own response section. The cluster you sent the request to is labelled as "(local)".

The querying cluster attempts to make a request to each remote cluster. If successful, connected=true.

The skip_unavailable setting for each remote cluster, as configured on the local cluster.

Indicates whether any index, alias or data stream matches the index expression specified for that cluster.

The Elasticsearch server version.

Identifying potential problems with your cross-cluster searchedit

The following request shows several examples of how modifying your query can prevent search failures.

GET /_resolve/cluster/not-present,clust*:my-index*,oldcluster:*?ignore_unavailable=false
{
  "(local)": {
    "connected": true,
    "skip_unavailable": false,
    "error": "no such index [not_present]"  
  },
  "cluster_one": {
    "connected": true,
    "skip_unavailable": true,
    "matching_indices": false,    
    "version": {
      "number": "8.13.0",
      "build_flavor": "default",
      "minimum_wire_compatibility_version": "7.17.0",
      "minimum_index_compatibility_version": "7.0.0"
    }
  },
  "cluster_two": {
    "connected": false,           
    "skip_unavailable": false,
    "matching_indices": true,
    "version": {
      "number": "8.13.0",
      "build_flavor": "default",
      "minimum_wire_compatibility_version": "7.17.0",
      "minimum_index_compatibility_version": "7.0.0"
    }
  },
  "oldcluster": {         
    "connected": true,
    "skip_unavailable": false,
    "matching_indices": true
  }
}

The local cluster has no index called not_present. Searching against it using the specified ignore_unavailable=false param will return a "no such index" error. Other types of errors can show up here as well, such as security permission errors when the user does not have authorization to search the specified index.

The cluster_one remote cluster has no indices that match the pattern my-index*. There may be no indices that match the pattern or the index could be closed. (You can check this by using the resolve index API.)

The cluster_two remote cluster is not connected (the attempt to connect failed). Since this cluster is marked as skip_unavailable=false, you should probably exclude this cluster from the search by adding -cluster_two:* to the search index expression.

The oldcluster remote cluster shows that it has matching indices, but no version information is included. This indicates that the cluster version predates the introduction of the _resolve/cluster API in 8.13.0., so you may want to exclude it from your cross-cluster search. (Note: the endpoint was able to tell there were matching indices because it fell back to using the resolve index API.)
« Resolve index API Rollover API »