This setting is only used with thepattern
filtertype and is a required setting.

It is important to note that while filters can be chained, each is linked by an implied logicalAND operation. If you want to match from one of several different patterns, as with a logicalOR operation, you can do so with thepattern filtertype usingregex as thekind.

This example shows how to select multiple indices based on them beginning with eitheralpha-,bravo-, orcharlie-:

filters:- filtertype: pattern  kind: regex  value: '^(alpha-|bravo-|charlie-).*$'

Explaining all of the different ways in which regular expressions can be used is outside the scope of this document, but hopefully this gives you some idea of how a regular expression pattern can be used when a logicalOR is desired.

- filtertype: pattern kind: prefix value: logstash-

- filtertype: pattern kind: prefix value: logstash- exclude: True

Internally, theprefix value is used to create aregex pattern:^{{0}}.*$. Any special characters should be escaped with a backslash to match literally.

- filtertype: pattern kind: suffix value: -prod

- filtertype: pattern kind: suffix value: -prod exclude: True

Internally, thesuffix value is used to create aregex pattern:^.*{{0}}$. Any special characters should be escaped with a backslash to match literally.

No age calculation takes place here. It is strictly a pattern match.

- filtertype: pattern kind: timestring value: '%Y.%m.%d'

- filtertype: pattern kind: timestring value: '%Y.%m.%d' exclude: True

Timestrings are parsed from strftime patterns, like%Y.%m.%d, into regular expressions. For example,%Y is 4 digits, so the regular expression for that looks like\d{{4}}, and%m is 2 digits, so the regular expression is\d{{2}}.

What this means is that a simple timestring to match year and month,%Y.%m will result in a regular expression like this:^.*\d{{4}}\.\d{{2}}.*$. This pattern will match any 4 digits, followed by a period., followed by 2 digits, occurring anywhere in the index name. This means itwill match monthly indices, likeindex-2016.12, as well as daily indices, likeindex-2017.04.01, which may not be the intended behavior.

To compensate for this, when selecting indices matching a subset of another pattern, use a second filter withexclude set toTrue

- filtertype: pattern kind: timestring value: '%Y.%m'- filtertype: pattern kind: timestring value: '%Y.%m.%d' exclude: True

This will prevent the%Y.%m pattern from matching the%Y.%m part of the daily indices.

This applies whether usingtimestring as a mere pattern match, or as part of date calculations.

- filtertype: pattern kind: regex value: '^a-|^b-|^c-'

- filtertype: pattern kind: regex value: '^a-|^b-|^c-' exclude: True