Hidden indicies wrongly matching with template with wildcard pattern

Hi elastic-team,

I am currently a bit confused.
We do have a template that looks like this:

PUT _template/denic-index-template?include_type_name
  "order": 100,
  "index_patterns": [
  "settings": {
    "index": {
      "format": "1",
      "lifecycle": {
        "name": "denic-index-policy"
      "number_of_shards": "1",
      "auto_expand_replicas": "0-1",
      "number_of_replicas": "1"
  "aliases": {},
  "mappings": {
    "_doc": {
      "_routing": {
        "required": false
      "numeric_detection": false,
      "dynamic_date_formats": [
        "yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"
      "_meta": {},
      "_source": {
        "excludes": [],
        "includes": [],
        "enabled": true
      "dynamic": true,
      "date_detection": true

This was initially brought in place to attach our lifecycle policy to indicies that do not match with any other pattern. Problem now is that it seems to attach this policy also to hidden indicies like for example the .kibana_x index which of course should not be touched...

So I have been looking around and was first thinking of adding a -.kibana* to the pattern of the above shown index template. However, then I found these two documentations: https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-index.html#multi-index
Where it says in the second:


Indicates whether the index should be hidden by default. Hidden indices are not returned by default when using a wildcard expression. This behavior is controlled per request through the use of the expand_wildcards parameter. Possible values are true and false (default).

So I it is pretty clear that I am confused now...
From what I read there I understand that normally hidden indicies should not be catched by a wildcard pattern.

Can someone please explain me what is going on? :thinking:

Nobody? :roll_eyes:

I added the -.* wildcard today before running to update to 7.9.3.
Still same .kibana_7 has been attached to a index lifecycle policy...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.