How can I query all index rollover failure logs?
I am trying with this query but it doesn’t return the expected logs -
GET .opendistro-ism-managed-index-history*/_search
{
“query”: {
“bool”: {
“must”: [
{
“term”: {
“managed_index_meta_data.action.failed”: {
“value”: true
}
}
},
{
“range”: {
“managed_index_meta_data.action.start_time”: {
“gte”: “now-365d”
}
}
}
]
}
},
“size”: 10000
}
