# Curator snapshot regex index

**URL:** <https://discuss.elastic.co/t/curator-snapshot-regex-index/27690>\
**Category:** Elasticsearch\
**Created:** [August 19, 2015, 4:24pm UTC](https://discuss.elastic.co/t/curator-snapshot-regex-index/27690 "2015-08-19T16:24:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bilsch](https://avatars.discourse-cdn.com/v4/letter/b/5f8ce5/32.png) [@bilsch](https://discuss.elastic.co/u/bilsch)\
**Post date:** [August 19, 2015, 4:24pm UTC](https://discuss.elastic.co/t/curator-snapshot-regex-index/27690/1 "2015-08-19T16:24:05Z")

</div>

I'm working on upgrading curator in our environment and running in to an issue using the newer curator.

Using the snapshot with a regex fails:

```
/usr/bin/curator --logfile /var/log/curator.log --loglevel INFO --logformat default --host foo --port 9200 snapshot --repository eslog_backups indices --time-unit days --older-than 4 --timestring '\%Y.\%m.\%d' --regex '^logstash-\d{4}\.\d{2}\.\d{2}$'
No indices matched provided args.

```

However if I use the same regex on a show indices I get matches

```
/usr/bin/curator --logfile /var/log/curator.log --loglevel INFO --logformat default --host foo --port 9200 show indices --regex '^logstash-\d{4}\.\d{2}\.\d{2}$'
logstash-2015.08.10
logstash-2015.08.11
logstash-2015.08.12
logstash-2015.08.13
logstash-2015.08.14
logstash-2015.08.17
logstash-2015.08.18
logstash-2015.08.19

```

Does the regex selection not work on the snapshot creation?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [August 19, 2015, 4:44pm UTC](https://discuss.elastic.co/t/curator-snapshot-regex-index/27690/2 "2015-08-19T16:44:36Z")

</div>

You omit the `--timestring '\%Y.\%m.\%d'` from your `show` command below. It's in the `snapshot` command you shared first, but not the show command. You may find that adding it yields identical results. You may not need to escape the `%` signs if they're encapsulated in single quotes. In many shells, I am able to run `--timestring %Y.%m.%d` without quoting or escaping. That may be the issue you're experiencing.

Additionally, you're making a redundant regex. `--timestring %Y.%m.%d` automatically filter with a generated regex of `^.*\d{4}\.\d{2}\.\d{2}.*$`. Adding your regex is filtering the same thing twice. You might get better results with `--prefix logstash-`, which would do one pass with a regex of `^logstash-.*$` and another with `^.*\d{4}\.\d{2}\.\d{2}.*$`.

You can see the regexes employed if you run with the `--debug` flag.

---

<div class="post-metadata">

**Author:** ![bilsch](https://avatars.discourse-cdn.com/v4/letter/b/5f8ce5/32.png) [@bilsch](https://discuss.elastic.co/u/bilsch)\
**Post date:** [August 19, 2015, 6:59pm UTC](https://discuss.elastic.co/t/curator-snapshot-regex-index/27690/3 "2015-08-19T18:59:27Z")

</div>

Ah, working now thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:54pm UTC](https://discuss.elastic.co/t/curator-snapshot-regex-index/27690/4 "2017-07-05T23:54:54Z")

</div>