count

- filtertype: count
  count: 10

This filtertype will iterate over the actionable list of indices or snapshots. They are ordered by age, or by alphabet, so as to guarantee that the correct items will remain in, or be removed from the actionable list based on the values of count, exclude, and reverse.

For use cases where "like" items are being counted, and their name pattern guarantees date sorting is equal to alphabetical sorting, it is unnecessary to set use_age to True, as item names will be sorted in reverse order by default. This means that the item count will start beginning with the newest indices or snapshots, and proceed through to the oldest.

Where this is not the case, the use_age setting can be used to ensure that index or snapshot ages are properly considered for sorting:

- filtertype: count
  count: 10
  use_age: True
  source: creation_date

All of the age-related settings from the age filter are supported, and the same restrictions apply with regard to filtering indices vs. snapshots.

- filtertype: count
  count: 1
  pattern: '^(.*)-\d{6}$'
  reverse: true

This particular example will match indices following the basic rollover pattern of indexname-######, and keep the highest numbered index for each group.

For example, given indices a-000001, a-000002, a-000003 and b-000006, and b-000007, the indices will would be matched are a-000003 and b-000007. Indices that do not match the regular expression in pattern will be automatically excluded.

This is particularly useful with indices created and managed using the Rollover API, as you can select only the active indices with the above example (exclude defaults to False). Setting exclude to True with the above example will remove the active rollover indices, leaving only those which have been rolled-over.

While this is perhaps most useful for the aforementioned scenario, it can also be used with age-based indices as well.

Using the default configuration, reverse is True. Given These indices:

index1
index2
index3
index4
index5

And this filter:

- filtertype: count
  count: 2

Indices index5 and index4 will be recognized as the 2 most recent, and will be removed from the actionable list, leaving index1, index2, and index3 to be acted on by the given action.

Similarly, given these indices:

index-2017.03.01
index-2017.03.02
index-2017.03.03
index-2017.03.04
index-2017.03.05

And this filter:

- filtertype: count
  count: 2
  use_age: True
  source: name
  timestring: '%Y.%m.%d'

The result will be similar. Indices index-2017.03.05 and index-2017.03.04 will be recognized as the 2 most recent, and will be removed from the actionable list, leaving index-2017.03.01, index-2017.03.02, and index-2017.03.03 to be acted on by the given action.

In some cases, you may wish to filter for the most recent indices. To accomplish this you set reverse to False:

- filtertype: count
  count: 2
  reverse: False

This time indices index1 and index2 will be the 2 which will be removed from the actionable list, leaving index3, index4, and index5 to be acted on by the given action.

Likewise with the age sorted indices:

- filtertype: count
  count: 2
  use_age: True
  source: name
  timestring: '%Y.%m.%d'
  reverse: True

Indices index-2017.03.01 and index-2017.03.02 will be the 2 which will be removed from the actionable list, leaving index-2017.03.03, index-2017.03.04, and index-2017.03.05 to be acted on by the given action.

• count

• reverse
• use_age
• pattern
• source (required if use_age is True)
• timestring (required if source is name)
• exclude (default is True)

• field (required if source is field_stats)
• stats_result (only used if source is field_stats)