Filtered query with wildcard index names vs Querying on aliases

Elastic Stack Elasticsearch
1

Scenario:
You have different indexes per day such as D1, D2, D3, .... .D10.
Now if you need data from only D1 and D2, which is best approach?

  1. Query with index with wildcard eg:D* and filter with date
  2. Create an alias for D1 and D2 and query on that
2

Option 2, or a new option 3:

Query just the two indices and filter with date: GET /D1,D2/my_type/_search.

Option 1 will technically work, but it will do extra computation that isn't needed. Because the wildcard will hit all indices, the search will be broadcast to all the involved shards (even if they aren't D1 or D2). So if you can limit the search to just D1 + D2, either via an alias or by specifying them manually, you'll have better performance :slight_smile: