A newer version is available. For the latest information, see the current release documentation.
Elastic Docs ›Curator Reference [5.1] ›Filters
« closed forcemerged »

countedit

- filtertype: count
  count: 10

Empty values and commented lines will result in the default value, if any, being selected. If a setting is set, but not used by a given filtertype, it may generate an error.

This filtertype will iterate over the actionable list of indices or snapshots. They are ordered by age, or by alphabet, so as to guarantee that the correct items will remain in, or be removed from the actionable list based on the values of count, exclude, and reverse.

Age-based sortingedit

For use cases, where "like" items are being counted, and their name pattern guarantees date sorting is equal to alphabetical sorting, it is unnecessary to set use_age to True, as item names will be sorted in reverse order by default. This means that the item count will start beginning with the newest indices or snapshots, and proceed through to the oldest.

Where this is not the case, the use_age setting can be used to ensure that index or snapshot ages are properly considered for sorting:

- filtertype: count
  count: 10
  use_age: True
  source: creation_date

All of the age-related settings from the age filter are supported, and the same restrictions apply with regard to filtering indices vs. snapshots.

Reversing sortingedit

Using the default configuration, reverse is True. Given These indices:

index1
index2
index3
index4
index5

And this filter:

- filtertype: count
  count: 2

Indices index5 and index4 will be recognized as the 2 most recent, and will be removed from the actionable list, leaving index1, index2, and index3 to be acted on by the given action.

Similarly, given these indices:

index-2017.03.01
index-2017.03.02
index-2017.03.03
index-2017.03.04
index-2017.03.05

And this filter:

- filtertype: count
  count: 2
  use_age: True
  source: name
  timestring: '%Y.%m.%d'

The result will be similar. Indices index-2017.03.05 and index-2017.03.04 will be recognized as the 2 most recent, and will be removed from the actionable list, leaving index-2017.03.01, index-2017.03.02, and index-2017.03.03 to be acted on by the given action.

In some cases, you may wish to filter for the most recent indices. To accomplish this you set reverse to False:

- filtertype: count
  count: 2
  reverse: False

This time indices index1 and index2 will be the 2 which will be removed from the actionable list, leaving index3, index4, and index5 to be acted on by the given action.

Likewise with the age sorted indices:

- filtertype: count
  count: 2
  use_age: True
  source: name
  timestring: '%Y.%m.%d'
  reverse: True

Indices index-2017.03.01 and index-2017.03.02 will be the 2 which will be removed from the actionable list, leaving index-2017.03.03, index-2017.03.04, and index-2017.03.05 to be acted on by the given action.

Required settingsedit

Optional settingsedit

Index-only settingsedit

  • field (required if source is field_stats)
  • stats_result (only used if source is field_stats)
« closed forcemerged »