# Elasticsearch Curator Snapshot: How does it work?

**URL:** https://discuss.elastic.co/t/elasticsearch-curator-snapshot-how-does-it-work/99278
**Category:** Elasticsearch
**Created:** [September 4, 2017, 10:36am UTC](https://discuss.elastic.co/t/elasticsearch-curator-snapshot-how-does-it-work/99278 "2017-09-04T10:36:07Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![NandhaKrishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nandhakrishna/32/26286_2.png) [@NandhaKrishna](https://discuss.elastic.co/u/NandhaKrishna)
#### Post date: [September 4, 2017, 10:36am UTC](https://discuss.elastic.co/t/elasticsearch-curator-snapshot-how-does-it-work/99278/1 "2017-09-04T10:36:07Z")

</div>

I have attached the example for Curator Snapshot.yml  
Will only the indices with names logstash- be snapshotted?  
How do I snapshot indices with different names?

```auto
---
# Remember, leave a key empty if there is no value. None will be a string,
# not a Python "NoneType"
#
# Also remember that all examples have 'disable_action' set to True. If you
# want to use this action as a template, be sure to set this to False after
# copying it.
actions:
  1:
    action: snapshot
    description: >-
      Snapshot logstash- prefixed indices older than 1 day (based on index
      creation_date) with the default snapshot name pattern of
      'curator-%Y%m%d%H%M%S'. Wait for the snapshot to complete. Do not skip
      the repository filesystem access check. Use the other options to create
      the snapshot.
    options:
      repository:
      # Leaving name blank will result in the default 'curator-%Y%m%d%H%M%S'
      name:
      ignore_unavailable: False
      include_global_state: True
      partial: False
      wait_for_completion: True
      skip_repo_fs_check: False
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: logstash-
      exclude:
    - filtertype: age
      source: creation_date
      direction: older
      unit: days
      unit_count: 
      exclude:

```

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [September 4, 2017, 2:45pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-snapshot-how-does-it-work/99278/2 "2017-09-04T14:45:55Z")

</div>

I took the liberty of editing your post to encapsulate it in triple back-ticks:

````
```
your post here
```

````

This is what you should do when pasting configuration files.

> [@NandhaKrishna](#):
>
> Will only the indices with names logstash- be snapshotted?

Based on the filters you have, it won't even work. You do have a `prefix` filter which will select only indices starting with `logstash-`, but you also have an `age` filter but have not defined a `unit_count`, which will result in an error. If you wanted to snapshot `logstash-` prefixed indices older than 30 days, you could put `30` after `unit_count:`, and then that's what would be snapshotted.

> [@NandhaKrishna](#):
>
> How do I snapshot indices with different names?

There are many different approaches you can take to snapshot more than just `logstash-` indices. What other patterns would you like to snapshot?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 2, 2017, 2:46pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-snapshot-how-does-it-work/99278/3 "2017-10-02T14:46:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
