# A kibana query with hot-warm-cold node

**URL:** <https://discuss.elastic.co/t/a-kibana-query-with-hot-warm-cold-node/201919>\
**Category:** Kibana\
**Created:** [October 2, 2019, 9:15am UTC](https://discuss.elastic.co/t/a-kibana-query-with-hot-warm-cold-node/201919 "2019-10-02T09:15:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kaiser\_Cheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiser_cheng/32/55237_2.png) [@Kaiser\_Cheng](https://discuss.elastic.co/u/Kaiser_Cheng)\
**Post date:** [October 2, 2019, 9:15am UTC](https://discuss.elastic.co/t/a-kibana-query-with-hot-warm-cold-node/201919/1 "2019-10-02T09:15:42Z")

</div>

We have a index with daily-based indexing.  
For example, hot node for a weak data , warm for a month, then move to cold node.

When we do a simple query in Kibana , ex doc count for last 15mins, how do we avoid searching old data in cold node? (I found the query to ES is still wild-card \* in index name even we query very fresh data)

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [October 2, 2019, 2:22pm UTC](https://discuss.elastic.co/t/a-kibana-query-with-hot-warm-cold-node/201919/2 "2019-10-02T14:22:49Z")

</div>

Kibana should be doing a range query, so this may explain

> [@Are shards skipped when a range query does not create hits](https://discuss.elastic.co/t/are-shards-skipped-when-a-range-query-does-not-create-hits/120239):
>
> In my templated mapping, I use a sort.field on a datetime field. That datetime field thus contains increasing values for the rows inserted during the day. I rollover daily, and do a force merge on older indices. I want to know if doing a range query on the datetime will know it can skip some indices based on the min and max value of the datetime field. I.e. not even having to talk to the shard(s). I found nothing in the doc or discussion forums. If I do a "profile":true in Kibana's dev tools,…

Is your 15 minute query pretty fast?

---

<div class="post-metadata">

**Author:** ![Kaiser\_Cheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiser_cheng/32/55237_2.png) [@Kaiser\_Cheng](https://discuss.elastic.co/u/Kaiser_Cheng)\
**Post date:** [October 2, 2019, 3:34pm UTC](https://discuss.elastic.co/t/a-kibana-query-with-hot-warm-cold-node/201919/3 "2019-10-02T15:34:08Z")

</div>

Currently, 15 min is still fast.  
So I confused too.

But if I query bigger range, like 3 days for example with Kibana, (still in hot node) for just doc counting,

It could be very slow.

So I guess it hit the warm nodes to check.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [October 4, 2019, 6:16pm UTC](https://discuss.elastic.co/t/a-kibana-query-with-hot-warm-cold-node/201919/4 "2019-10-04T18:16:30Z")

</div>

You might be able to research in Kibana devtools search profiler.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2019, 6:16pm UTC](https://discuss.elastic.co/t/a-kibana-query-with-hot-warm-cold-node/201919/5 "2019-11-01T18:16:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.