Alias-Dashboard/Visualizations-Cold indicies-Errors

Elastic Stack Elasticsearch
1

We have an index pattern: search-ids.
That index pattern is mapped for: ids-alert-*

We recently closed and froze indices that were not being searched.
Since our index pattern encompasses every single index- it keeps looking at old indices it doesn't need to and produces errors.

Is there a work around? A smarter/better way to set the index pattern?

2

For clarification: is there any way to set a "rolling" index pattern.
If our active index is at ids-alert-00200 there's no need for us to query indices ids-alert-00001 or ids-alert-00002 (they would be entirely too old).
Rather than making the index pattern map to ids-alert-* is there a way to make the index pattern only follows the 50 most recent indices? Or have the index pattern set by date? Anything so that the index pattern will only be attached to relevant indices.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.