Wildcard index name with date range filter


I'm having trouble figuring out whether I can safely use wildcard index names when I have a date range filter, ie whether ES will do magic to query only those indices that should be required by a given date range. For example using daily indices, and querying a 15m window with a filter like this:

"filter": { "bool": { "must": [ { "range" : {
  "@timestamp": { "gte": 1489986129286, "lte": 1489987029286, "format": "epoch_millis" }
} } ] } }

Can I use a wildcard in the index name like /indexname-* and expect only the relevant index to be hit?

In 5.x series there is now some magic behind the scene. This is what we called instant aggregations in Kibana.

But you need to set size to 0. Read https://www.elastic.co/blog/instant-aggregations-rewriting-queries-for-fun-and-profit

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.