So I am playing around a little with wildcards in our cluster setup (1 ccs, 3 data cluster)
When I do cross-cluster searches on indexes using wildcards I am a bit curious of the behavior.
Let's say we have 6 months of data which is divided into aliases time/size based indices.
If I do this search (replace the month with anything from 01 to 06)
GET /*:myindex-2019.06.*/_search it takes ~1 second
But this search takes about 30 seconds, but based on the initial search the logical would be a maximum of 10s with some overhead.
GET /*:myindex-2019.*/_search
is there a logic behind that the second wildcards become so expensive?