# Wildcard queries on date based indexes, searches all indexes?

**URL:** <https://discuss.elastic.co/t/wildcard-queries-on-date-based-indexes-searches-all-indexes/194121>\
**Category:** Elasticsearch\
**Created:** [August 7, 2019, 12:38am UTC](https://discuss.elastic.co/t/wildcard-queries-on-date-based-indexes-searches-all-indexes/194121 "2019-08-07T00:38:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aharon](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@Aharon](https://discuss.elastic.co/u/Aharon)\
**Post date:** [August 7, 2019, 12:38am UTC](https://discuss.elastic.co/t/wildcard-queries-on-date-based-indexes-searches-all-indexes/194121/1 "2019-08-07T00:38:24Z")

</div>

About me:  
ES: 6.5.4  
X-PACK Document Security on all indexes  
200TB of date based indexes  
Multi-tenant environment  
7 days of data on Hot data nodes  
180 days in Warm data nodes

Question:  
If I have a user log into Kibana Discover, select time range of "last 15 minutes", and then do a wildcard search like \* log \* (had to put spaces in there for this forum), it then searches all indexes (ie. dates other than today). I can tell this through slow query logs, hot threads, and the fact that the warm nodes peg CPU and Disk I/O (warm nodes have indexes with dates \> 7 days).

Am I misunderstanding how date filters work? I assumed an index would not be searched if it contained no data within the time range selected. I may also have the same issue with non-wildcard queries, but it's hard to tell with those since the queries return too fast and are not impacting the cluster.

Thank you for the help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 12:38am UTC](https://discuss.elastic.co/t/wildcard-queries-on-date-based-indexes-searches-all-indexes/194121/2 "2019-09-04T00:38:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
