# Filter Indices Syntax in ILM policy

**URL:** <https://discuss.elastic.co/t/filter-indices-syntax-in-ilm-policy/305020>\
**Category:** Kibana\
**Tags:** slm-snapshot-lifecycle-management, snapshot-and-restore\
**Created:** [May 18, 2022, 6:21am UTC](https://discuss.elastic.co/t/filter-indices-syntax-in-ilm-policy/305020 "2022-05-18T06:21:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Siavash\_Fazli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siavash_fazli/32/103915_2.png) [@Siavash\_Fazli](https://discuss.elastic.co/u/Siavash_Fazli)\
**Post date:** [May 18, 2022, 6:21am UTC](https://discuss.elastic.co/t/filter-indices-syntax-in-ilm-policy/305020/1 "2022-05-18T06:21:32Z")

</div>

Hi all,

I defined some policies to take snapshots in time intervals,  
now I need to create a policy that takes a snapshot from all indices except selected indices in previous policies,  
for example, this is my policy:

```auto
PUT /_slm/policy/slm_arvan_idx_daily
{
  "schedule": "0 15 1 * * ?", 
  "name": "<ss_general.indices_daily_{now/d}>", 
  "repository": "my_repo", 
  "config": { 
    "indices": ["coz", "heartbeat", "logstash", "messaging_logs", "metrix_event",
                "metricbeat", ".security-7", "vas_user_information"], 
    "ignore_unavailable": true,
    "include_global_state": false
  },
  "retention": { 
    "expire_after": "30d", 
    "min_count": 5, 
    "max_count": 14 
  }
}

```

Now I want to create a new policy that includes all indices except the above indices.

What is the syntax of except in indices line??

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 19, 2022, 10:54pm UTC](https://discuss.elastic.co/t/filter-indices-syntax-in-ilm-policy/305020/2 "2022-05-19T22:54:00Z")

</div>

You can use syntax like `-heartbeat` to exclude indices.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2022, 10:54pm UTC](https://discuss.elastic.co/t/filter-indices-syntax-in-ilm-policy/305020/3 "2022-06-16T22:54:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.