<p dir="auto">In my org, each team is creating ES index daily so the number of index grows very quickly.  Usually users are interested only in their 'team' data.  Currently, some users execute query using Kibana w/o specifying index and field name(it takes _all').   Such queries at times, bring our cluster to halt/ crash etc.  I would like queries to be restricted such that only well defined queries can be executed on ES.  A well defined query is a query which specifies index and field name.  I could not find a server level config param to enforce such constraint on user queries.  I posted question on ES forum but did not get a clear answer.</p>
<p dir="auto">This bug/ ER filed to have ES server level parameter such as to enforce user defined queries to have index name and/ or field name specified.</p>
<p dir="auto">Hitting <code class="notranslate">/_search</code> causes elasticsearch to search all types, all indices.<br>
With very large indices this is a problem.<br>
We currently have ~30Tb of data across multiple logstash indices.</p>
<p dir="auto">If someone talks to ES (eg, using sense or a other method) and doesn't specify the index name, the cluster effectively grinds to a half until we restart it.</p>
<p dir="auto">Can we have an option to require specifying at least one index name to the search endpoint?</p>
<p dir="auto">Thanks!</p>