List indices
list_indicesRead-only
List indices with health, status, and document counts to see what exists before querying. Filter with a pattern to narrow to specific indices, such as arkime_sessions3-* for network traffic.
Instructions
List indices with their health, status, and document count.
Use this to discover which indices exist before querying one. For the field
schema (field names and types) of a single index, use index_mapping instead;
for cluster-wide health rather than per-index status, use cluster_health.
Returns a JSON array, one object per index, with name, health, status, and doc
count.
This reads OpenSearch's index list directly, so Malcolm's own internals
come back beside the traffic, and most of what is listed holds no
network data at all (.kibana_1, .opendistro_security, the arkime_*_v*
config indices, top_queries-*). The traffic is in the arkime_sessions3-*
indices alone; Arkime opens a new one per day, so their number grows and
the newest is usually still empty — read "docs.count" rather than the
name to find the one carrying the capture. A pattern matching nothing
returns an empty array, not an error. "health" is a shard-replication
fact and says nothing about whether capture is still arriving —
malcolm_data_coverage answers that.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | No | Index name or wildcard to match; default "*" returns all. Only matching indices are returned, e.g. "arkime_sessions3-*", which is the narrowing that skips Malcolm's internal indices. | * |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |