# Set Limit for Date Filter in Elastic cluster **URL:** \ **Category:** Kibana\ **Created:** [July 9, 2022, 10:06am UTC](https://discuss.elastic.co/t/set-limit-for-date-filter-in-elastic-cluster/309247 "2022-07-09T10:06:29Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![lstoneir](https://avatars.discourse-cdn.com/v4/letter/l/b9bd4f/32.png) [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Post date:** [July 9, 2022, 10:06am UTC](https://discuss.elastic.co/t/set-limit-for-date-filter-in-elastic-cluster/309247/1 "2022-07-09T10:06:29Z")
Hi I have a general question! I have a elastic with a lot of docs in index! I want to set threshold on datetime filter and not allow users to execute heavy queries on cluster. for example i set datetime\_max\_filter = 7days then if user enter date filter gt 7 days, kibana or elastic raise exception "please select time filter lte 7 days!" Is this possible? (version 7.10.1) ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [July 14, 2022, 10:19pm UTC](https://discuss.elastic.co/t/set-limit-for-date-filter-in-elastic-cluster/309247/2 "2022-07-14T22:19:19Z")
There's a couple of open issues for similar requests. You could add a comment on these; > > > \*\*Describe the feature:\*\* Add an optional setting on index patterns in Kibana t…hat lets you configure a limit on the timespan used for queries on that index. > > \*\*Describe a specific use case for the feature:\*\* > A user at an AMA booth approached me with this problem they were having. They have 2 types of indices. One type has small docs and/or sparse docs over time, and they would often query large timespans on these indices in Discover. The other type of index has very large docs and/or a high frequency of docs over time. > When they switch index from the small index type to the large index type in Discover while they had a large timespan selected in the time picker, then Discover is going to run the query against that large timespan with negative consequences. > > I think this optional setting would have choices similar to the timepicker quick choices, 1 hour, 4 hours, 12 hours, 23 hours, week, month, N months... At the max end, you just don't select the option which means unlimited timespan. > > > \*\*Describe the feature:\*\* > > In order to prevent users from creating very expens…ive queries lets introduce a new ui setting \`max\_timepicker\_range\` which if set and user tries to select a range larger that the one in the setting we would show an error (notification, or inside timepicker itself) saying that the range is larger than the maximum allowed, > > \*\*Describe a specific use case for the feature:\*\* > > This is an attempt to limit the impact of large queries on the cluster and ensure that only reasonable time frames are being analysed. There is a rather convoluted way you might be able to accomplish this now if you have daily indices. For example, if you had indices like `logstash-2022.07.13` for each day, you could create an alias that includes the last 7 days and some kind of scheduled task that updates that alias every day. Think of it as a "rolling 7-day alias". Then you create an Index Pattern (now called a Data View in the latest versions) for that alias. You could still also have a `logstash-*` Index Pattern that only admins had access to. Here's an example that creates an alias named `kibana_sample_data` for all 3 of the sample data sets; ```auto POST /_aliases { "actions": [ { "add": { "index": "kibana_sample_data_ecommerce", "alias": "kibana_sample_data", "is_write_index": true } }, { "add": { "index": "kibana_sample_data_flights", "alias": "kibana_sample_data" } }, { "add": { "index": "kibana_sample_data_logs", "alias": "kibana_sample_data" } } ] } ``` The script to do the alias would require some date math and would depend on what language you're most comfortable with. Regards, Lee ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [July 14, 2022, 11:28pm UTC](https://discuss.elastic.co/t/set-limit-for-date-filter-in-elastic-cluster/309247/3 "2022-07-14T23:28:17Z")
I got pretty close with this bash line; `for i in {0..6}; do echo curl -XPOST https://elastic:changeit@localhost:9200/_aliases -k -H \'"Content-Type: application/json"\' -d \'"{ \"actions\": [{ \"add\": { \"index\": \"logstash-$(date -v-${i}d '+%Y.%m.%d')-000001\", \"alias\": \"test\" } }] }"\'; done` It outputs lines to the console like this; ```auto curl -XPOST https://elastic:changeit@localhost:9200/_aliases -k -H 'Content-Type: application/json' -d '{ "actions": [{ "add": { "index": "logstash-2022.07.14-000001", "alias": "test" } }] }' curl -XPOST https://elastic:changeit@localhost:9200/_aliases -k -H 'Content-Type: application/json' -d '{ "actions": [{ "add": { "index": "logstash-2022.07.13-000001", "alias": "test" } }] }' curl -XPOST https://elastic:changeit@localhost:9200/_aliases -k -H 'Content-Type: application/json' -d '{ "actions": [{ "add": { "index": "logstash-2022.07.12-000001", "alias": "test" } }] }' curl -XPOST https://elastic:changeit@localhost:9200/_aliases -k -H 'Content-Type: application/json' -d '{ "actions": [{ "add": { "index": "logstash-2022.07.11-000001", "alias": "test" } }] }' curl -XPOST https://elastic:changeit@localhost:9200/_aliases -k -H 'Content-Type: application/json' -d '{ "actions": [{ "add": { "index": "logstash-2022.07.10-000001", "alias": "test" } }] }' curl -XPOST https://elastic:changeit@localhost:9200/_aliases -k -H 'Content-Type: application/json' -d '{ "actions": [{ "add": { "index": "logstash-2022.07.09-000001", "alias": "test" } }] }' curl -XPOST https://elastic:changeit@localhost:9200/_aliases -k -H 'Content-Type: application/json' -d '{ "actions": [{ "add": { "index": "logstash-2022.07.08-000001", "alias": "test" } }] }' ``` And if I copy/paste those lines, they work and create the alias which allows me to query those 7 indices. But my attempts to remove the `echo` from that command and have it just work have failed with syntax errors. I'm sure it has something to do with escaping the quotes. Maybe a different language would be better. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 11, 2022, 11:29pm UTC](https://discuss.elastic.co/t/set-limit-for-date-filter-in-elastic-cluster/309247/4 "2022-08-11T23:29:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.