Github user merrimanr commented on the issue:
https://github.com/apache/metron/pull/797
Just tested this and worked as expected. The only question I have is
whether the "error" index should be included since it is used to store errors
and not alerts. I can't think of a case where you would include "error" in a
search along with other indices. I'm looking at this from the perspective of
the Alerts UI so I don't necessarily think it needs to be done in this PR but
it will need to be filtered out at some point.
---
