I have a concern regarding the change in Kibana 6.x to no longer support "time-interval based index patterns". Instead, we now use wildcards. Below is an example of my concern.
Let's say we have a large number of daily indices (i.e., several hundreds for the past few years) and only intend to search over data in the past 24H. Isn't it extremely inefficient to search over ALL of these indices when all relevant data is contained in just 2 indices (today and yesterday) at most? Prior to Kibana 6, it would smartly restrict the indices that are searched over based on the time range selected.
By the way, I did find a similar post to my concern here:
@Christian_Dahlqvist responded saying this: "more recently querying all indices has been made much more efficient in Elasticsearch". Does this mean that there were improvements made to the time range query performance? Is the overhead (of querying hundreds of indices versus just 1-2 in my example) so minimal that it's not worth restricting queries to only the relevant (time-based) indices?
Thanks in advance!