Kibana4 not specifying date in search index [SOLVED]

So we've been looking at moving to Kibana4.x lately but have noticed that simple 15min duration Discover queries take a long time (10 -60 seconds). Upon investigation it seems that Kibana4.1.7 does a msearch where it specifies the indices with a wildcard index (e.g. logstash-*) as opposed to using the actual date(s) (e.g. logstash-2016.03.25).

This is causing a huge performance hit. Why was this change made and is there any way to have the indices specified in a similar way to kibana3? It seems silly to search all indices for the last 15 minutes of data if you know that will be in a specific index with today's date.

Any ideas, similar experiences, fixes?

Specifically which version of Kibana 4.x are you evaluating? There are different ways to improve this depending on the version of Kibana you're using.

Hi Lukas,

I'm using 4.1.7. Since I'm still on elasticsearch 1.7.5 I think that's the top version I can use.

Thanks for the response,

OK, so I discovered how to do this. When you specify the index initially (Configure an index pattern) you also must check the Use event times to create index names checkbox.

Sorry I didn't respond sooner! Yes, this is the correct setting to use.

For future versions of Kibana, we've optimized this so you can still use a wildcard index (e.g. logstash-*) without having to specify name-based indices. (See