pattern

edit
- filtertype: pattern
 kind: prefix
 value: logstash-
 exclude: False

Empty values and commented lines will result in the default value, if any, being selected. If a setting is set, but not used by a given filtertype, it may generate an error.

This filtertype will iterate over the actionable list and match indices matching a given pattern. They will remain in, or be removed from the actionable list based on the value of exclude.

Filter chaining

It is important to note that while filters can be chained, each is linked by an implied logical AND operation. If you want to match from one of several different patterns, as with a logical OR operation, you can do so with the pattern filtertype using regex as the kind.

This example shows how to select multiple indices based on them beginning with either alpha-, bravo-, or charlie-:

  filters:
  - filtertype: pattern
    kind: regex
    value: '^(alpha-|bravo-|charlie-).*$'

Explaining all of the different ways in which regular expressions can be used is outside the scope of this document, but hopefully this gives you some idea of how a regular expression pattern can be used when a logical OR is desired.

Read more about the different settings for this filtertype:

Required settings

edit

Optional settings

edit