Curator current month to date

(Craig Patrick) #1


Is there a way in Curator I can add an alias to all indices in the current month? So, if say today is 1st Feb (which is it) how would I set up an alias action to add an alias of "current_month" to anything from the first day of the current month?

I've tried:

      - filtertype: pattern
        kind: prefix
        value: event-
      - filtertype: age
        source: name
        direction: younger
        timestring: '%Y.%m.%d'
        unit: months
        unit_count: 0

and also unit_count: 1 but that basically takes everything from a month ago. Is there a way to say "take everything from the 1st of this month to now"?

Many thanks

(Aaron Mildenstein) #2

Not in the way you're requesting, not yet anyway. There is an issue open for that on GitHub:

(Craig Patrick) #3

Wow, yes that's perfect - thanks @theuntergeek - and once again for the reply - excellent level of support!

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.