# ILM Performance in search

**URL:** <https://discuss.elastic.co/t/ilm-performance-in-search/307951>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [June 23, 2022, 7:07am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951 "2022-06-23T07:07:40Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yariv\_Moshe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yariv_moshe/32/107469_2.png) [@Yariv\_Moshe](https://discuss.elastic.co/u/Yariv_Moshe)\
**Post date:** [June 23, 2022, 7:07am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951/1 "2022-06-23T07:07:41Z")

</div>

Hi,  
I want to use ILM to create a new index per day or month.  
my question is how it going to affect search performance if old indexes will move to the warm | cold stage with pure HW.  
let's say that I have a query range last day or last week. according to ILM documentation, the alias point to all historical indexes, which means Elastic will try to search the documents from all indexes - even old indexes stored on pure HW - doesn't it make the search slow?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 23, 2022, 7:59am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951/2 "2022-06-23T07:59:57Z")

</div>

Welcome to our community! 😃

I guess that depends on your hardware at a first level.

---

<div class="post-metadata">

**Author:** ![Yariv\_Moshe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yariv_moshe/32/107469_2.png) [@Yariv\_Moshe](https://discuss.elastic.co/u/Yariv_Moshe)\
**Post date:** [June 23, 2022, 8:40am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951/3 "2022-06-23T08:40:53Z")

</div>

Hi,  
Is there any optimization that Elastic know do search only on relevant indexes instead of search on very old indexes ( in case im looking on last day range)  
Tnx

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 23, 2022, 8:53am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951/4 "2022-06-23T08:53:24Z")

</div>

Have a look at [this thread](https://discuss.elastic.co/t/data-stream-with-hot-warm-cold-tiers-read-performance/307192).

In older versions this was indeed an issue and Kibana has over the years implemented a few different workarounds. In recent versions this is however no longer considered an issue and all indices belonging to the pattern are queried.

---

<div class="post-metadata">

**Author:** ![Yariv\_Moshe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yariv_moshe/32/107469_2.png) [@Yariv\_Moshe](https://discuss.elastic.co/u/Yariv_Moshe)\
**Post date:** [June 26, 2022, 7:13am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951/5 "2022-06-26T07:13:00Z")

</div>

My question is different i think..  
what is the improvements between 2 scenarios in search operation for last month data:  
option 1: one big index  
option 2: monthly indexes - that most of them moved to slowly machines (warm | cold)  
is there any optimizations that ELK know not to go to old indexes since im looking to new data even if im using index alias that point to all indexes?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 26, 2022, 7:36am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951/6 "2022-06-26T07:36:29Z")

</div>

> [@Yariv\_Moshe](#):
>
> option 1: one big index

The most efficient way to delete data in Elasticsearch is to delete complete indices. This is why time-based indices are generally recommended when dealing with data having a specific retention period. Deleteing data from a single index using delete-by-query is a LOT less efficient and adds overhead.

> [@Yariv\_Moshe](#):
>
> option 2: monthly indexes - that most of them moved to slowly machines (warm | cold)  
> is there any optimizations that ELK know not to go to old indexes since im looking to new data even if im using index alias that point to all indexes?

Elasticsearch will query all indices but each node will efficiently be able to tell if a shard holds data that could be relevant, e.g. based on the timestamp field and range clauses on this field. If a shard clearly does not hold any relevant data it can quickly be skipped.

---

<div class="post-metadata">

**Author:** ![Yariv\_Moshe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yariv_moshe/32/107469_2.png) [@Yariv\_Moshe](https://discuss.elastic.co/u/Yariv_Moshe)\
**Post date:** [June 26, 2022, 7:48am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951/7 "2022-06-26T07:48:55Z")

</div>

many thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2022, 7:49am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951/8 "2022-07-24T07:49:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
