Scope Kibana Discover results to a time window with an index pattern

The useful answer

If Kibana Discover returns events from every index and every date, queries scan more data than necessary and the results are hard to act on. The supported way to scope results is to create an index pattern that names a time field, then bound Discover to a relative window such as now-30d to now. Once the time field is registered, Kibana applies the selected range to timestamped queries automatically.

What an index pattern does

An index pattern is Kibana's mapping to one or more Elasticsearch indices or data streams. It tells Kibana which indices to search and which field holds the event time—commonly @timestamp. Without a time field, Discover cannot apply a meaningful time range, and the time picker has nothing to constrain.

Worked configuration

Perform these steps in the Kibana UI. Required permissions: access to Stack Management or Management, depending on the Kibana release, and the privilege to create index patterns.

1. Open Stack Management (or Management in older releases) > Index Patterns > Create index pattern.
2. Enter a pattern name such as logs-*. Avoid a lone *, which can match too many indices and slow the UI.
3. Select the time field. Choose @timestamp if your events use it; otherwise select the field that records event time.
4. Complete the pattern creation. Kibana lists the available fields from the matching indices.

In Discover, open the time picker and choose Last 30 days, or type a relative range such as now-30d to now. To make the bound explicit in the query bar, add a filter such as:

@timestamp >= now-30d

Placeholder: replace @timestamp with your index's time field if it uses a different name. Expected check: the result count should drop, and the visible timestamps should fall inside the selected window.

Some Kibana versions also offer field format options that change how timestamp values render in the table view. Exact menu paths and format names vary by release, so confirm them against your installed version before documenting them for a team.

Limits and common mistakes

• Pattern size: Index pattern names are commonly limited to 255 characters, and a pattern can reference up to 1,000 indices. Very large index sets can degrade Discover performance.
• Wildcards: Broad patterns such as * may match indices with incompatible mappings and cause slow loading or field conflicts.
• Missing time field: If no time field is selected, the time picker cannot constrain results, and relative ranges such as now-30d have no effect.
• Query syntax: Date-math syntax differs between KQL and Lucene. Verify which query language Discover is using before pasting filter examples.
• Field format changes: In older Kibana releases, some display-format changes reportedly required a restart. Confirm whether your version requires one.

How to check the result

1. Open Index Patterns and confirm the pattern lists your chosen time field.
2. Open Discover, set the time picker to now-30d through now, and run a search.
3. Confirm that returned documents have timestamps inside that window and that the hit count is smaller than an unbounded search.
4. If you added a query filter, toggle it off and on to verify the result count changes accordingly.

Rollback

Creating an index pattern writes to Kibana's internal configuration index. To remove it, open Index Patterns, select the pattern, and delete it. Deleting the pattern does not delete Elasticsearch data; it only removes Kibana's saved view of those indices.

Review notes

This draft relies on general Kibana behavior and the supplied research notes. Before publishing, verify the exact UI path (Stack Management versus Management), the supported field-format options, and the 255-character / 1,000-index limits against the target Kibana version. Do not present version-specific UI labels as tested unless confirmed in your environment.