The source from which to derive the index or snapshot age. Can be one of
name as the
source tells Curator to look for a
timestring within the index or snapshot name, and convert
that into an epoch timestamp (epoch implies UTC).
- filtertype: age source: name direction: older timestring: '%Y.%m.%d' unit: days unit_count: 3
A word about regular expression matching with timestrings
Timestrings are parsed from strftime patterns, like
%Y.%m.%d, into regular
expressions. For example,
%Y is 4 digits, so the regular expression for that
%m is 2 digits, so the regular expression is
What this means is that a simple timestring to match year and month,
will result in a regular expression like this:
pattern will match any 4 digits, followed by a period
., followed by 2 digits,
occurring anywhere in the index name. This means it will match monthly
index-2016.12, as well as daily indices, like
index-2017.04.01, which may not be the intended behavior.
To compensate for this, when selecting indices matching a subset of another
pattern, use a second filter with
exclude set to
- filtertype: pattern kind: timestring value: '%Y.%m' - filtertype: pattern kind: timestring value: '%Y.%m.%d' exclude: True
This will prevent the
%Y.%m pattern from matching the
%Y.%m part of the
This applies whether using
timestring as a mere pattern match, or as part of
creation_date extracts the epoch time of index or snapshot creation.
- filtertype: age source: creation_date direction: older unit: days unit_count: 3
source can only be
field_stats when filtering indices.
field must be of type
date in Elasticsearch.
- filtertype: age source: field_stats direction: older unit: days unit_count: 3 field: '@timestamp' stats_result: min_value