This setting is not common. It is most frequently used for testing.
unit, unit_count, and optionally, epoch, are used by Curator to establish the moment in time point of reference with this formula:
point_of_reference = epoch - ((number of seconds in unit) * unit_count)
If epoch is unset, the current time is used. It is possible to set a point of reference in the future by using a negative value for unit_count.
- filtertype: age source: creation_date direction: older unit: days unit_count: 3 epoch: 1491577200
The value for this setting must be an epoch timestamp. In this example, the
given epoch time of
1491577200 is 2017-04-04T15:00:00Z (UTC). This will use
3 days older than that timestamp as the point of reference for age comparisons.
Intro to Kibana
ELK for Logs & Metrics