Hi,
While it is possible, it is always good idea to test the scale of monitoring. Searching multiple indexes of different names with one alert can put a strain on the performance. Keep an eye on that, but if you'll set a reasonable timeframe parameter, you should be fine.
To search for multiple indexes, use array format, without white signs, like so: syslog*,skimmer*
