nameedit

Note

This setting is used by the alias, create_index and snapshot, actions.

The value of this setting is the name of the alias, snapshot, or index, depending on which action makes use of name.

date mathedit

This setting may be a valid Elasticsearch date math string.

A date math name takes the following form:

<static_name{date_math_expr{date_format|time_zone}}>

static_name

is the static text part of the name

date_math_expr

is a dynamic date math expression that computes the date dynamically

date_format

is the optional format in which the computed date should be rendered. Defaults to YYYY.MM.dd.

time_zone

is the optional time zone . Defaults to utc.

The following example shows different forms of date math names and the final form they resolve to given the current time is 22rd March 2024 noon utc.

Expression Resolves to

<logstash-{now/d}>

logstash-2024.03.22

<logstash-{now/M}>

logstash-2024.03.01

<logstash-{now/M{YYYY.MM}}>

logstash-2024.03

<logstash-{now/M-1M{YYYY.MM}}>

logstash-2024.02

<logstash-{now/d{YYYY.MM.dd|+12:00}}>

logstash-2024.03.23

strftimeedit

This setting may alternately contain a valid Python strftime string. Curator will extract the strftime identifiers and replace them with the corresponding values.

The identifiers that Curator currently recognizes include:

UnitValue

%Y

4 digit year

%y

2 digit year

%m

2 digit month

%W

2 digit week of the year

%d

2 digit day of the month

%H

2 digit hour of the day, in 24 hour notation

%M

2 digit minute of the hour

%S

2 digit second of the minute

%j

3 digit day of the year

action: alias
description: "Add/Remove selected indices to or from the specified alias"
options:
  name: alias_name
add:
  filters:
  - filtertype: ...
remove:
  filters:
  - filtertype: ...

This option is required by the alias action, and has no default setting in that context.

For the create_index action, there is no default setting, but you can use strftime:

action: create_index
description: "Create index as named"
options:
  name: 'myindex-%Y.%m'
  # ...

or use Elasticsearch date math

action: create_index
description: "Create index as named"
options:
  name: '<logstash-{now/d+1d}>'
  # ...

to name your indices. See more in the create_index documenation.

action: snapshot
description: >-
  Snapshot selected indices to 'repository' with the snapshot name or name
  pattern in 'name'.  Use all other options as assigned
options:
  repository: my_repository
  name:
  include_global_state: True
  wait_for_completion: True
  max_wait: 3600
  wait_interval: 10
filters:
- filtertype: ...

For the snapshot action, the default value of this setting is curator-%Y%m%d%H%M%S