'allocation_type' works as expected, and so was a bust for what I'm trying to do.
It appears this works:
- filtertype: pattern
kind: prefix
value: logs-
- filtertype: allocated
key: box_type
value: hot
exclude: True
- filtertype: allocated
key: box_type
value: cold
exclude: True
By elimination, I can select 'warm' indices. I can't do it by selection, apparently.
This has been driving me nuts for the last week or so!