A kibana query with hot-warm-cold node

[Kaiser_Cheng]

We have a index with daily-based indexing.
For example, hot node for a weak data , warm for a month, then move to cold node.

When we do a simple query in Kibana , ex doc count for last 15mins, how do we avoid searching old data in cold node? (I found the query to ES is still wild-card * in index name even we query very fresh data)

[rugenl (Len Rugen)]

Kibana should be doing a range query, so this may explain

Are shards skipped when a range query does not create hits

In my templated mapping, I use a sort.field on a datetime field. That datetime field thus contains increasing values for the rows inserted during the day. I rollover daily, and do a force merge on older indices. I want to know if doing a range query on the datetime will know it can skip some indices based on the min and max value of the datetime field. I.e. not even having to talk to the shard(s). I found nothing in the doc or discussion forums. If I do a "profile":true in Kibana's dev tools,…

Is your 15 minute query pretty fast?

[Kaiser_Cheng]

Currently, 15 min is still fast.
So I confused too.

But if I query bigger range, like 3 days for example with Kibana, (still in hot node) for just doc counting,

It could be very slow.

So I guess it hit the warm nodes to check.

[rugenl (Len Rugen)]

You might be able to research in Kibana devtools search profiler.