I recently upgraded from ES 1.7 to 6.3, so have a lot to learn. I thought i head read in some documentation that ES is smart enough to know what indices to query based on timestamp fields.
If i wanted to search 7/1 thru 7/3 is ES 1.7, I would search like this:
Is this still necessary, or can I simply do:
and supply a range filter for the @timesamp field in the query and ES will figure out which indices to search?
From my limited testing the queries seem to run just as fast if I specify logstash-* or if i specifiy the exact index names. I just want to confirm this is the case.
Any info on this? I can't find any conclusive documentation
_index filter is faster than
range filter on more indexes.
range filter is smart enough to see
min/max values of the
shards/segments and early-terminate the query ?
Still, the shard would need to do some type of processing even with early-terminate, so better to restrict number of indexes that you're querying.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.