Date math for index names - date range possible?

Elastic Stack Elasticsearch
1

EDIT: The question could be rephrased also as:

When working with date based indexes, Is it any better to provide the exact indexes for searching (potentially a huge list):
GET /whatever-YYYYMM01,whatever-YYYYMM02,...

OR

GET /whatever-*

  • date range query

I've been assuming that it's better to provide the exact indexes, but the query string can be huge and exceed HTTP's maximum allowed length for GET

I was wondering if there's an easy way to perform an index pattern definition where the index name depends on the date, based on a date range (start_date, end_date)

I've been trying to fit some date math in the index names such as suggested here:

https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html

It looks very limited - I can do things such as:

GET /<whatever-{now/d{YYYYMMdd|+12:00}}>/_search

but apparently I cannot define a simple date range between two dates.

My indexes are named: whatever-YYYYMMDD

If i require to query over a year, I'm forced to do either:

  1. GET /whatever-* (might not be the best option as my retention policy is for three years)
  2. Programatically expand the range to individual indexes names and do GET /whatever-YYYYMM01,whatever-YYYYMM02,... , YYYYMMXX => Fails as the GET string is longer than what supports HTTP
  3. Do several searches iterating over several ranges (calculated)
  4. Other options?

Any suggestion is appreciated

Thanks

2

Hi,
would it be possible to use wildcards like whatever-2016* and whatever-2015-12*, whatever-2015-11* etc. it seems like that would reduce the number of expressions you have to provide, although you do have a bit of logic in your application to build that.

Does that make sense?