Hi,
We're using ILM to enable a hot/warm/cold architecture. We ingest quite a lot of data, and try to keep them for 90 days.
Ingest is running smoothly, but I'm trying to speed up the querying.
When I run a time based query on the filebeat-* index, I hit all the nodes, which is quite slow.
Is the correct solution to comma separate the time based indices, and only query the indices in the range of the requested time range?