Wildcard index name with date range filter

Elastic Stack Elasticsearch
1

Hi,

I'm having trouble figuring out whether I can safely use wildcard index names when I have a date range filter, ie whether ES will do magic to query only those indices that should be required by a given date range. For example using daily indices, and querying a 15m window with a filter like this:

"filter": { "bool": { "must": [ { "range" : {
  "@timestamp": { "gte": 1489986129286, "lte": 1489987029286, "format": "epoch_millis" }
} } ] } }

Can I use a wildcard in the index name like /indexname-* and expect only the relevant index to be hit?

2

In 5.x series there is now some magic behind the scene. This is what we called instant aggregations in Kibana.

But you need to set size to 0. Read https://www.elastic.co/blog/instant-aggregations-rewriting-queries-for-fun-and-profit

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.