# Help with curator pattern value

**URL:** <https://discuss.elastic.co/t/help-with-curator-pattern-value/102489>\
**Category:** Elasticsearch\
**Created:** [October 2, 2017, 9:28pm UTC](https://discuss.elastic.co/t/help-with-curator-pattern-value/102489 "2017-10-02T21:28:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\
**Post date:** [October 2, 2017, 9:28pm UTC](https://discuss.elastic.co/t/help-with-curator-pattern-value/102489/1 "2017-10-02T21:28:29Z")

</div>

Hi Everyone,

I am trying to do a bulk delete and is struggling with defining pattern for it. Any help would be appreciated.

cloudtrail-test-dev-2017.09.17 vQk3HfDBRF2PBlPgLL6Kkg 3 1 26050 0 64.7mb 32.4mb  
cloudtrail-test-dev-2017.09.05 ajssF3k2R\_64SPkBOXskLQ  
cloudtrail-test-dev-2017.09.06 NE9iiXOsQzGSRUQoGyshxA  
cloudtrail-test-prod-2017.09.25 E7MbVCRtQa2LZybWSoNfYA 3 1 1985 0 10.3mb 5.2mb  
cloudtrail-test-dev-2017.09.15 fg2b0SjRR66ycgM239CFCA  
cloudtrail-test-prod-2017.09.19 unR-ONR\_TVKbDUMk3McGIg 3 1 24924 0 64.5mb 32.2mb  
cloudtrail-test-dev-2017.10.02 -PrJiZwrScCkKTg7EMrhPg 3 1 22052 0 55.2mb 27.6mb

I want to delete all the indices that has 2017.09 in it.

--  
Niraj

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [October 3, 2017, 1:17am UTC](https://discuss.elastic.co/t/help-with-curator-pattern-value/102489/2 "2017-10-03T01:17:15Z")

</div>

This could be done with the `pattern` filter, using `kind: regex`:

```auto
filters:
- filtertype: pattern
  kind: regex
  value: '^.*2017\.09.*$'

```

When testing new configurations, be sure to use the `--dry-run` flag first, to make sure it does what you expect.

---

<div class="post-metadata">

**Author:** ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\
**Post date:** [October 3, 2017, 2:02am UTC](https://discuss.elastic.co/t/help-with-curator-pattern-value/102489/3 "2017-10-03T02:02:40Z")

</div>

> [@theuntergeek](#):
>
> ^._2017.09._$

@theuntergeek Thanks for the quick response. Below is my curator action file.

```
actions:
  1:
    action: delete_indices
    description: >-
      Closes indices older than 15 days (based on index name), for custom-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: '^.*2017\.09.*$'
    filters:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 15 

```

When i try to run the curator using dry run i see that it also takes values from .08 month. Am i doing something wrong here?

```
2017-10-02 18:56:03,447 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.08.23 (CLOSED) with arguments: {}
2017-10-02 18:56:03,447 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.08.24 (CLOSED) with arguments: {}
2017-10-02 18:56:03,447 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.08.25 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.08.26 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.08.27 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.08.28 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.08.29 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.08.30 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.08.31 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.01 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.02 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.03 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.04 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.05 (CLOSED) with arguments: {}
2017-10-02 18:56:03,448 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.06 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.07 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.08 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.09 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.10 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.11 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.12 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.13 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.14 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.15 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.16 (CLOSED) with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.17 with arguments: {}
2017-10-02 18:56:03,449 INFO DRY-RUN: delete_indices: cloudtrail-dev-2017.09.18 with arguments: {}
2017-10-02 18:56:03,452 INFO Action ID: 1, "delete_indices" completed.
2017-10-02 18:56:03,452 INFO Job completed.

```

--  
Niraj

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [October 3, 2017, 4:49am UTC](https://discuss.elastic.co/t/help-with-curator-pattern-value/102489/4 "2017-10-03T04:49:43Z")

</div>

You have 2 `filters` blocks. That will not work. You must remove one or merge them.

---

<div class="post-metadata">

**Author:** ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\
**Post date:** [October 3, 2017, 3:23pm UTC](https://discuss.elastic.co/t/help-with-curator-pattern-value/102489/5 "2017-10-03T15:23:43Z")

</div>

@theuntergeek Thanks. Seems like removing the last one worked perfectly fine. Appreciate the help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2017, 3:24pm UTC](https://discuss.elastic.co/t/help-with-curator-pattern-value/102489/6 "2017-10-31T15:24:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.