Can I dynamically specify indices to search?

Elastic Stack Elasticsearch
1

Hi there,

I have a question for Watcher. Can I dynamically specify indices to search?

Example:
I have multiple logs, named in the format: "log-yyyy-mm-dd", like "log-2016-12-14".
I have a watch run every 5 mins, searching for exceptions in log indices in last 30 mins.
Currently, my watch search all indices. It is kind of wasting resource. I would like to specify the indices, to use only today and yesterday's indices. It means I need to dynamically specify indices to search.

How can I do that?

Thanks,

Da

2

Yes, you can use index date math[1] to specify an index.

[1] https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html

3

That's cool! I'll give it a try :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.