-00000x`"
most everytime I retrive data using @timestamp because this is timeseries data
"@timestamp" \> now() - interval X hour
when I use myindex-\* does it scan all the index or just latest one?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 18, 2023, 10:24pm UTC](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239/2 "2023-04-18T22:24:21Z")
Elasticsearch will use [Field capabilities API | Elasticsearch Guide [8.7] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-field-caps.html) to exclude indices that may not match your query, so you can use wildcards.
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [April 19, 2023, 1:13pm UTC](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239/3 "2023-04-19T13:13:06Z")
Hi Mark,
but sometime when I use my-index-\* it timesout.
but exactly on same time if I use myindex-toda\_date-xxxx it works.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 19, 2023, 1:43pm UTC](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239/4 "2023-04-19T13:43:44Z")
Are you using a date range filter in you query?
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [April 19, 2023, 1:54pm UTC](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239/5 "2023-04-19T13:54:04Z")
yes date range. this is metricbeat index and using @timestamp, all the data are timeseries
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 19, 2023, 2:10pm UTC](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239/6 "2023-04-19T14:10:26Z")
The query should pre-filter the indices based on the time range when using a data view or wildcard.
Use the search profiler to see what is going on.
Example when I put this is the profiler
logs-\*
```auto
{
"query": {
"bool": {
"must": [],
"filter": [
{
"range": {
"@timestamp": {
"format": "strict_date_optional_time",
"gte": "2023-04-19T13:51:20.382Z",
"lte": "2023-04-19T14:06:20.382Z"
}
}
}
],
"should": [],
"must_not": []
}
}
}
```
I see that it only searches the relevant indices ... take a look what yours is doing
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [April 19, 2023, 9:15pm UTC](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239/7 "2023-04-19T21:15:02Z")
Wow I never used this search profiler.
in my case it is not doing optimal it is even going some random index which are few week old. and I used exact query that you had.
for obvious reason I can't copy-paste screen shot of it. but it is looking in to total 7 index on "query Profile" window.
my metricbeat index is xyz-7.17.1 but it is looking in to four of the old index xyz-7.12.0
hmm. but if I select index as latest one it profiler shows only one being used, as obvious.
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [April 19, 2023, 9:22pm UTC](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239/8 "2023-04-19T21:22:00Z")
Hi Stephen,
it seems like behavior are different on manually created rollover index (via pattern/ilm) then data stream.
I have another system which I updated to 8.5.3 and has metricbeat data handled by data stream is doing exactly what expect to do.
i.e if i use date 2023-04-10 then it is only looking in to that day index.
if I use date 2023-01-01 then it is only looking in to that day index.
I guess I will have to live with old way untill I can upgrade them.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2023, 9:22pm UTC](https://discuss.elastic.co/t/use-data-view-or-direct-index/330239/9 "2023-05-17T21:22:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.