Exclude cold and frozen data from a rule

Rules that query cold and frozen data might perform more slowly. To exclude cold and frozen data, add a Query DSL filter that ignores cold and frozen data tiers when executing. You can add the filter when creating a new rule or updating an existing one.

Here is a sample Query DSL filter that excludes frozen tier data from a rule’s execution:

{
   "bool":{
      "must_not":{
         "terms":{
            "_tier":[
               "data_frozen"
            ]
         }
      }
   }
}

Here is another sample Query DSL filter that excludes cold and frozen tier data from a rule’s execution:

{
   "bool":{
      "must_not":{
         "terms":{
            "_tier":[
               "data_frozen", "data_cold"
            ]
         }
      }
   }
}