Efficient time-based multi index searches in ES6

I recently upgraded from ES 1.7 to 6.3, so have a lot to learn. I thought i head read in some documentation that ES is smart enough to know what indices to query based on timestamp fields.

If i wanted to search 7/1 thru 7/3 is ES 1.7, I would search like this:


Is this still necessary, or can I simply do:
and supply a range filter for the @timesamp field in the query and ES will figure out which indices to search?

From my limited testing the queries seem to run just as fast if I specify logstash-* or if i specifiy the exact index names. I just want to confirm this is the case.

Any info on this? I can't find any conclusive documentation

_index filter is faster than range filter on more indexes.

Probably the range filter is smart enough to see min/max values of the shards/segments and early-terminate the query ?

Still, the shard would need to do some type of processing even with early-terminate, so better to restrict number of indexes that you're querying.

I may be mixing "rollover" into this as well, interesting read: https://www.elastic.co/blog/managing-time-based-indices-efficiently

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.