Can I dynamically specify indices to search?


(Da Tao) #1

Hi there,

I have a question for Watcher. Can I dynamically specify indices to search?

I have multiple logs, named in the format: "log-yyyy-mm-dd", like "log-2016-12-14".
I have a watch run every 5 mins, searching for exceptions in log indices in last 30 mins.
Currently, my watch search all indices. It is kind of wasting resource. I would like to specify the indices, to use only today and yesterday's indices. It means I need to dynamically specify indices to search.

How can I do that?



(Steve Kearns) #2

Yes, you can use index date math[1] to specify an index.


(Da Tao) #3

That's cool! I'll give it a try :slight_smile:

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.