1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
|
---
mapped_pages:
- https://www.elastic.co/guide/en/elasticsearch/client/curator/current/fe_kind.html
---
# kind [fe_kind]
::::{note}
This setting is only used with the [pattern](/reference/filtertype_pattern.md)<br> filtertype and is a required setting.
::::
This setting tells the [pattern](/reference/filtertype_pattern.md) what pattern type to match. Acceptable values for this setting are `prefix`, `suffix`, `timestring`, and `regex`.
::::{admonition} Filter chaining
:class: note
It is important to note that while filters can be chained, each is linked by an implied logical **AND** operation. If you want to match from one of several different patterns, as with a logical **OR** operation, you can do so with the [pattern](/reference/filtertype_pattern.md) filtertype using *regex* as the `kind`.
This example shows how to select multiple indices based on them beginning with either `alpha-`, `bravo-`, or `charlie-`:
```yaml
filters:
- filtertype: pattern
kind: regex
value: '^(alpha-|bravo-|charlie-).*$'
```
Explaining all of the different ways in which regular expressions can be used is outside the scope of this document, but hopefully this gives you some idea of how a regular expression pattern can be used when a logical **OR** is desired.
::::
There is no default value. This setting must be set by the user or an exception will be raised, and execution will halt.
The different `kinds` are described as follows:
## prefix [_prefix_2]
To match all indices starting with `logstash-`:
```yaml
- filtertype: pattern
kind: prefix
value: logstash-
```
To match all indices *except* those starting with `logstash-`:
```yaml
- filtertype: pattern
kind: prefix
value: logstash-
exclude: True
```
::::{note}
Internally, the `prefix` value is used to create a *regex* pattern: `^{{0}}.*$`. Any special characters should be escaped with a backslash to match literally.
::::
## suffix [_suffix_2]
To match all indices ending with `-prod`:
```yaml
- filtertype: pattern
kind: suffix
value: -prod
```
To match all indices *except* those ending with `-prod`:
```yaml
- filtertype: pattern
kind: suffix
value: -prod
exclude: True
```
::::{note}
Internally, the `suffix` value is used to create a *regex* pattern: `^.*{{0}}$`. Any special characters should be escaped with a backslash to match literally.
::::
## timestring [_timestring_2]
::::{important}
No age calculation takes place here. It is strictly a pattern match.
::::
To match all indices with a Year.month.day pattern, like `index-2017.04.01`:
```yaml
- filtertype: pattern
kind: timestring
value: '%Y.%m.%d'
```
To match all indices *except* those with a Year.month.day pattern, like `index-2017.04.01`:
```yaml
- filtertype: pattern
kind: timestring
value: '%Y.%m.%d'
exclude: True
```
::::{admonition} A word about regular expression matching with timestrings
:class: warning
Timestrings are parsed from strftime patterns, like `%Y.%m.%d`, into regular expressions. For example, `%Y` is 4 digits, so the regular expression for that looks like `\d{{4}}`, and `%m` is 2 digits, so the regular expression is `\d{{2}}`.
What this means is that a simple timestring to match year and month, `%Y.%m` will result in a regular expression like this: `^.*\d{{4}}\.\d{{2}}.*$`. This pattern will match any 4 digits, followed by a period `.`, followed by 2 digits, occurring anywhere in the index name. This means it *will* match monthly indices, like `index-2016.12`, as well as daily indices, like `index-2017.04.01`, which may not be the intended behavior.
To compensate for this, when selecting indices matching a subset of another pattern, use a second filter with `exclude` set to `True`
```yaml
- filtertype: pattern
kind: timestring
value: '%Y.%m'
- filtertype: pattern
kind: timestring
value: '%Y.%m.%d'
exclude: True
```
This will prevent the `%Y.%m` pattern from matching the `%Y.%m` part of the daily indices.
**This applies whether using `timestring` as a mere pattern match, or as part of date calculations.**
::::
## regex [_regex_2]
This `kind` allows you to design a regular-expression to match indices or snapshots:
To match all indices starting with `a-`, `b-`, or `c-`:
```yaml
- filtertype: pattern
kind: regex
value: '^a-|^b-|^c-'
```
To match all indices *except* those starting with `a-`, `b-`, or `c-`:
```yaml
- filtertype: pattern
kind: regex
value: '^a-|^b-|^c-'
exclude: True
```
|
