Date math for index names - date range possible?

EDIT: The question could be rephrased also as:

When working with date based indexes, Is it any better to provide the exact indexes for searching (potentially a huge list):
GET /whatever-YYYYMM01,whatever-YYYYMM02,...


GET /whatever-*

  • date range query

I've been assuming that it's better to provide the exact indexes, but the query string can be huge and exceed HTTP's maximum allowed length for GET

I was wondering if there's an easy way to perform an index pattern definition where the index name depends on the date, based on a date range (start_date, end_date)

I've been trying to fit some date math in the index names such as suggested here:

It looks very limited - I can do things such as:

GET /<whatever-{now/d{YYYYMMdd|+12:00}}>/_search

but apparently I cannot define a simple date range between two dates.

My indexes are named: whatever-YYYYMMDD

If i require to query over a year, I'm forced to do either:

  1. GET /whatever-* (might not be the best option as my retention policy is for three years)
  2. Programatically expand the range to individual indexes names and do GET /whatever-YYYYMM01,whatever-YYYYMM02,... , YYYYMMXX => Fails as the GET string is longer than what supports HTTP
  3. Do several searches iterating over several ranges (calculated)
  4. Other options?

Any suggestion is appreciated



would it be possible to use wildcards like whatever-2016* and whatever-2015-12*, whatever-2015-11* etc. it seems like that would reduce the number of expressions you have to provide, although you do have a bit of logic in your application to build that.

Does that make sense?