I've read so much on this, but dated information, and wondered if things have changed or anyone knows of a good way to handle this in kibana/elastic.
So given an index name that has a date in it e.g events_10_2018 with 10 being october and 2018 being year.
When we setup and index pattern of events_* that obviously selects every month.
If we ask for last 30 days in the time picker in Kibana, it appears to be searching all the indexes including where there is no data in those indexes, i.e events_09_2018. This is causing a massive overhead and performance problem.
I know we could create index pattern for each month or year, but that is a headache maintenance wise, and as each visualisation links to an index pattern it's an issue.
So is there a better way to ensure kibana is aware that the index name contains month and year, and uses that when it's filtering with the time picker? Or can I use the value of the time picker in filters for each visualisation for the _index field?
We are using Elastic 6.42 and Kibana 6.42
thanks in advance.....