For Elasticsearch rollover feature, normally there is an alias for write and the other one for reading. The write alias includes the latest index, but the read one includes all indexes.
I'm concerning the performance penalty of searching for all indexes. I know that there is per-processing called canmatch to have a precheck. But I'm still concerning the read performance if there are thousands of indexes within the read alias.
Previously, our application is creating an index every day, in search, it designates the indexes which are required for search based on timestamp rather than search all index by index*.
The rollover feature is pretty cool, for the read performance, is there anyone who has experience and best practise.
Welcome to our community! 
Elasticsearch has smarts built in to skip indices that will not contain data relevant to the query, so this shouldn't be an issue.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.