Curator snapshot regex index

Elastic Stack Elasticsearch
1

I'm working on upgrading curator in our environment and running in to an issue using the newer curator.

Using the snapshot with a regex fails:

/usr/bin/curator --logfile /var/log/curator.log --loglevel INFO --logformat default --host foo --port 9200 snapshot --repository eslog_backups indices  --time-unit days --older-than 4 --timestring '\%Y.\%m.\%d' --regex '^logstash-\d{4}\.\d{2}\.\d{2}$'
No indices matched provided args.

However if I use the same regex on a show indices I get matches

/usr/bin/curator --logfile /var/log/curator.log --loglevel INFO --logformat default --host foo --port 9200 show indices --regex '^logstash-\d{4}\.\d{2}\.\d{2}$'
logstash-2015.08.10
logstash-2015.08.11
logstash-2015.08.12
logstash-2015.08.13
logstash-2015.08.14
logstash-2015.08.17
logstash-2015.08.18
logstash-2015.08.19

Does the regex selection not work on the snapshot creation?

2

You omit the --timestring '\%Y.\%m.\%d' from your show command below. It's in the snapshot command you shared first, but not the show command. You may find that adding it yields identical results. You may not need to escape the % signs if they're encapsulated in single quotes. In many shells, I am able to run --timestring %Y.%m.%d without quoting or escaping. That may be the issue you're experiencing.

Additionally, you're making a redundant regex. --timestring %Y.%m.%d automatically filter with a generated regex of ^.*\d{4}\.\d{2}\.\d{2}.*$. Adding your regex is filtering the same thing twice. You might get better results with --prefix logstash-, which would do one pass with a regex of ^logstash-.*$ and another with ^.*\d{4}\.\d{2}\.\d{2}.*$.

You can see the regexes employed if you run with the --debug flag.

3

Ah, working now thanks!