It seemed faster in other cases, but was only anecdotal and was deleting an order of magnitude fewer documents. Thanks for the feedback. More & more, it seems like the value of multiple types in an index is diminishing. Wondering if I'd be better off with more type/process specific indexes (eg syslog-YEAR.MONTH, appA-YEAR.MONTH, appB-YEAR.MONTH) instead of more general indexes (eg logstash-YEAR.MONTH.DAY). A bit off-topic, but I'd be interested in hearing if anyone else made a similar transition and how that worked out for them.