# Filter snapshot by filename

**URL:** <https://discuss.elastic.co/t/filter-snapshot-by-filename/148409>\
**Category:** Elasticsearch\
**Created:** [September 13, 2018, 5:13am UTC](https://discuss.elastic.co/t/filter-snapshot-by-filename/148409 "2018-09-13T05:13:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ardel](https://avatars.discourse-cdn.com/v4/letter/a/a9a28c/32.png) [@ardel](https://discuss.elastic.co/u/ardel)\
**Post date:** [September 13, 2018, 5:13am UTC](https://discuss.elastic.co/t/filter-snapshot-by-filename/148409/1 "2018-09-13T05:13:59Z")

</div>

Hello All,

Suppose that we have snapshot that has this format of filename curator-20180813011640, how can I filter that by day?

This is the current filter that I used but I cannot get the snapshot that I need to delete

```
- filtertype: age
  source: name
  direction: older
  timestring: '%Y.%m.%d%H%M'
  unit: days
  unit_count: 1
  exclude:

```

Thank you in Advance

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [September 13, 2018, 11:55am UTC](https://discuss.elastic.co/t/filter-snapshot-by-filename/148409/2 "2018-09-13T11:55:46Z")

</div>

If you notice, that’s a pretty specific date. It represents Curator execution time. Snapshots all have an internal metadata timestamp that should be within a second or two of that time that represents snapshot creation time. You can use `source: creation_date` instead of `name` in your age filter, and can safely omit the `timestring`.

---

<div class="post-metadata">

**Author:** ![ardel](https://avatars.discourse-cdn.com/v4/letter/a/a9a28c/32.png) [@ardel](https://discuss.elastic.co/u/ardel)\
**Post date:** [September 14, 2018, 10:05am UTC](https://discuss.elastic.co/t/filter-snapshot-by-filename/148409/3 "2018-09-14T10:05:51Z")

</div>

> [@theuntergeek](#):
>
> source: creation\_date

It worked.

Thanks a lot!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2018, 10:05am UTC](https://discuss.elastic.co/t/filter-snapshot-by-filename/148409/4 "2018-10-12T10:05:54Z")

</div>

Closed on October 12, 2018, 10:05am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.