# Delete all indices exept some based on the index name

**URL:** https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536
**Category:** Elasticsearch
**Tags:** curator
**Created:** [July 1, 2021, 10:06am UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536 "2021-07-01T10:06:21Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![rizvaughan](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)
#### Post date: [July 1, 2021, 10:06am UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536/1 "2021-07-01T10:06:21Z")

</div>

Hello all,  
We are using curator to delete indices after a certain amount of time in our environments. I am facing an issue with understanding how to make it work for deleting indices based on time but leaving some indices which have a particular string in the name.  
For example : Delete all indices older than 4 weeks except the indices which have "secure" in it's name.  
Here is my configuration :

```auto
---
actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 4 weeks (based on index name).
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: regex
      value: '*secure*'
      exclude: True
    - filtertype: pattern
      kind: regex
      value: '*loyalty*'
      exclude: True
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%W'
      unit: weeks
      unit_count: 4
      exclude:

```

Here is the error I get when I run it.

```auto
Failed to complete action: delete_indices. <class 'sre_constants.error'>: nothing to repeat

```

Could anybody help me understand how to do it or what am I doing wrong here?  
Thank you.

---

<div class="post-metadata">

### Author: ![rizvaughan](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)
#### Post date: [July 3, 2021, 12:17am UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536/2 "2021-07-03T00:17:28Z")

</div>

I found out what the issue was. It was with regex. I changed the regex to `'.*secure*.'`. I have one similar index called `'.*unsecure*.'`and I would like to make another action file to delete these both indices after 8 weeks instead of 4 weeks for all other indices. I am not able to combine both. When I make two filters and run curator, it gives me empty list.

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [July 13, 2021, 9:14pm UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536/3 "2021-07-13T21:14:08Z")

</div>

You should immediately recognize the problem in that `'.*secure*.'` will also match `'.*unsecure*.'` because of how regular expressions work.

If you want to use the period `.` as part of the match, then you should escape it with a backslash. I am going on the assumption that you're looking for the final period with this example:

`'.*secure.*\.'` will match `indexname.secure.12345`, and also `indexname.unsecure.23456`.

However, `'.*\.secure\..*'` will match `indexname.secure.12345` and _not_ match `indexname.unsecure.23456`.

---

<div class="post-metadata">

### Author: ![rizvaughan](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)
#### Post date: [July 13, 2021, 9:52pm UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536/4 "2021-07-13T21:52:38Z")

</div>

Hi @theuntergeek ,  
Thank you for your reply. Yes, you are right about the regex. I have forgot to update the question because I have changed the index name totally, it's "loyalty". So in short, I have one index called "_secure_"(ex my-index.secure-2021.24) and the other one is "loyalty"(ex my-index.loyalty-2021.24). Separately both work as expected but I am not able to combine both in one action file.

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [July 14, 2021, 1:05pm UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536/5 "2021-07-14T13:05:38Z")

</div>

In that case, what you're looking to do is add a logical OR to your regex pattern:

```auto
    filters:
    - filtertype: pattern
      kind: regex
      value: '*secure*|*loyalty*'
      exclude: True

```

(or something rather like this).

---

<div class="post-metadata">

### Author: ![rizvaughan](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)
#### Post date: [July 15, 2021, 8:47am UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536/6 "2021-07-15T08:47:00Z")

</div>

Hi @theuntergeek ,  
Thank you again.  
Yes,it can be done. I didn't think of that. My bad.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 12, 2021, 8:47am UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536/7 "2021-08-12T08:47:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
