Search does not consider maximum index age

[runningman84]

Our big system hosts 10+ TB data. This allows us to look back about 12 days.

If I search using a time range like a 2015-04-01 00:00:00.000 +00:00 - 2015-04-02 00:00:00.000 +00:00. Graylog needs several seconds to execute this search. Why is graylog doing a search at all if it knows that the index data doesn't last longer than 12 days. (the first message appears at 2015-04-16 00:00:00.000 +00:00).

Furthermore I would like to see a hint that my search did not give any results due to not having any data before 2015-04-16 00:00:00.000 +00:00.

[kroepke]

Graylog always searches in the current write index, because it does not
store metadata about that index. The delay is probably due to loading field
data.

We will see if we can change this alongside with the issue reported about
the index ranges problem (don't have the issue number at hand).
On Apr 28, 2015 1:20 PM, "runningman84" [email protected] wrote:

Our big system hosts 10+ TB data. This allows us to look back about 12
days.

If I search using a time range like a 2015-04-01 00:00:00.000 +00:00 -
2015-04-02 00:00:00.000 +00:00. Graylog needs several seconds to execute
this search. Why is graylog doing a search at all if it knows that the
index data doesn't last longer than 12 days. (the first message appears at
2015-04-16 00:00:00.000 +00:00).

Furthermore I would like to see a hint that my search did not give any
results due to not having any data before 2015-04-16 00:00:00.000 +00:00.

—
Reply to this email directly or view it on GitHub
#1238.