patternedit
- filtertype: pattern kind: prefix value: logstash- exclude: False
Empty values and commented lines will result in the default value, if any, being selected. If a setting is set, but not used by a given filtertype, it may generate an error.
This filtertype will iterate over the actionable list and match indices matching a given pattern. They will remain in, or be removed from the actionable list based on the value of exclude.
Filter chaining
It is important to note that while filters can be chained, each is linked by an implied logical AND operation. If you want to match from one of several different patterns, as with a logical OR operation, you can do so with the pattern filtertype using regex as the kind.
This example shows how to select multiple indices based on them beginning with
either alpha-, bravo-, or charlie-:
filters:
- filtertype: pattern
kind: regex
value: '^(alpha-|bravo-|charlie-).*$'
Explaining all of the different ways in which regular expressions can be used is outside the scope of this document, but hopefully this gives you some idea of how a regular expression pattern can be used when a logical OR is desired.
Read more about the different settings for this filtertype:
Required settingsedit
Optional settingsedit
-
exclude (default is
False)