Hi. I'm brand new to Elasticsearch and Watcher, so I'm still finding my way around. We have daily indices of the form myindex-YYYY.MM.DD, and I've set up a watch that can search them using...
"indices" : [ "myindex-*" ]
... along with a date range to look at the last hour or however long I want.
But because we keep the daily indices for a long time and thus there's a ton of data, I want to limit the search to the current and previous day's index, using something similar to "now" in the "indices" specification -- conceptually something like this:
"indices" : [ "myindex-[today], myindex-[yesterday]" ]
Is it possible to do that, or do I need to let it search all of the daily indices and let the date range throw out all of the data in the older days' indices, as I'm doing now? Thanks.