Allow configuring per index query timespan limits #24906
Labels
enhancement
New value added to drive a business result
Feature:Data Views
Data Views code and UI - index patterns before 8.0
Feature:Kibana Management
Feature label for Data Views, Advanced Setting, Saved Object management pages
Icebox
impact:low
Addressing this issue will have a low level of impact on the quality/strength of our product.
loe:small
Small Level of Effort
Team:DataDiscovery
Discover, search (e.g. data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL.
Describe the feature: Add an optional setting on index patterns in Kibana that lets you configure a limit on the timespan used for queries on that index.
Describe a specific use case for the feature:
A user at an AMA booth approached me with this problem they were having. They have 2 types of indices. One type has small docs and/or sparse docs over time, and they would often query large timespans on these indices in Discover. The other type of index has very large docs and/or a high frequency of docs over time.
When they switch index from the small index type to the large index type in Discover while they had a large timespan selected in the time picker, then Discover is going to run the query against that large timespan with negative consequences.
I think this optional setting would have choices similar to the timepicker quick choices, 1 hour, 4 hours, 12 hours, 23 hours, week, month, N months... At the max end, you just don't select the option which means unlimited timespan.
The text was updated successfully, but these errors were encountered: