I'm tracking user sessions as docs in ES.
Each session is a single doc that gets updated when ever the session state changes.
I'm using daily based indices, and the ID of the doc is the session ID (UUID).
If a session starts before the end of a day, but continues on to the next day, the update will look for it only in the next day's index and thus won't find it and will create a new doc, right?
How can I make logstash look up the doc in multiple indices so I will really only have a single doc per session? Or is there a better way to handle this?