Elasticsearch-Querty and Fetch phase

Elastic Stack Elasticsearch
1

I am wondering if I can get a little clarification. When a query is run:

"The coordinating node identifies which documents need to be fetched and issues a multi GET request to the relevant shards."

I am wondering what determines "relevant shards."
For example our index pattern for a search is "search-ids" and is mapped to "ids-alerts-*"

If our users attempt to run a query that is only one day old, will Elasticsearch automatically attempt to query every single index (because ids-alerts-* was selected) or will it recognize that it only needs to view the most recent index to retrieve the relevant data.

2

The most recent, or the ones that contain the data with matching timestamps, yes :slight_smile:

3

Thanks for the response. This is what leaves me a little confused. We recently closed and/or froze some very old indices (over 6 months old).

Our users then began receiving shard errors on their visualizations. These visualizations were only querying data from this week alone. The shard errors would show that they the visualization was trying to access index-xxxxx which we could see was one of the old indices that we had closed.

We werent sure why Elastic kept trying to look at month old indices when the time frame for the query should only look at the most recent index.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.