# Creating a snapshot of indices created with alias

**URL:** https://discuss.elastic.co/t/creating-a-snapshot-of-indices-created-with-alias/131979
**Category:** Elasticsearch
**Created:** [May 15, 2018, 4:53pm UTC](https://discuss.elastic.co/t/creating-a-snapshot-of-indices-created-with-alias/131979 "2018-05-15T16:53:31Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![bm1391](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bm1391](https://discuss.elastic.co/u/bm1391)
#### Post date: [May 15, 2018, 4:53pm UTC](https://discuss.elastic.co/t/creating-a-snapshot-of-indices-created-with-alias/131979/1 "2018-05-15T16:53:31Z")

</div>

I am using curator to create snapshots of my indices. I am also rolling over my indices with the rollover API. Here is what my index looks like when creating and rolling over.

```
audit-2018.05.14-1
audit-2018.05.14-000002

```

Here is my config file for the curator:

```
actions:
  1:
    action: snapshot
    description: >-
      Snapshot log-production- prefixed indices older than 1 day (based on index
      creation_date) with the default snapshot name pattern of
      'curator-%Y%m%d%H%M%S'. Wait for the snapshot to complete. Do not skip
      the repository filesystem access check. Use the other options to create
      the snapshot.
    options:
      repository: data_backup

    # Leaving name blank will result in the default 'curator-%Y%m%d%H%M%S'
      name: testlogs-%Y%m%d%H%M%S
      ignore_unavailable: False
      include_global_state: True
      partial: False
      wait_for_completion: True
      skip_repo_fs_check: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: audit-
      #value: benchmark-
    - filtertype: age
      source: creation_date
      timestring: '^.*\d{4}\.\d{2}.\d{2}'
      direction: older
      unit: days
      unit_count: 1

```

Curator throws a error everytime saying it cant fin any indices. I know the problem is the timestring added because the index  
`audit-2018.05.14`  
works fine and it finds the index.

I have tried adding a timestring to match the other format but it is not catching it.

Thank you for any help

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [May 15, 2018, 6:14pm UTC](https://discuss.elastic.co/t/creating-a-snapshot-of-indices-created-with-alias/131979/2 "2018-05-15T18:14:15Z")

</div>

> [@bm1391](#):
>
> ```
> source: creation_date
> timestring: '^.*\d{4}\.\d{2}.\d{2}'
> 
> ```

`timestring` is not used unless you set `source: name`. This would not do anything.

```auto
    - filtertype: age
      source: creation_date
      direction: older
      unit: hours
      unit_count: 1

```

I suggest using the above block with `--dry-run` set on the command-line and see if it finds indices.  
With `loglevel: DEBUG` in your config file, you can run with `--dry-run` and see the timestamp values of `creation_date` and be able to see what age the indices actually are.

---

<div class="post-metadata">

### Author: ![bm1391](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bm1391](https://discuss.elastic.co/u/bm1391)
#### Post date: [May 15, 2018, 6:29pm UTC](https://discuss.elastic.co/t/creating-a-snapshot-of-indices-created-with-alias/131979/3 "2018-05-15T18:29:09Z")

</div>

Bingo. Knew I was missing something small.

Thanks a ton, Aaron

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2018, 6:29pm UTC](https://discuss.elastic.co/t/creating-a-snapshot-of-indices-created-with-alias/131979/4 "2018-06-12T18:29:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.