# Hidden indicies wrongly matching with template with wildcard pattern

**URL:** <https://discuss.elastic.co/t/hidden-indicies-wrongly-matching-with-template-with-wildcard-pattern/252184>\
**Category:** Elasticsearch\
**Created:** [October 15, 2020, 11:27am UTC](https://discuss.elastic.co/t/hidden-indicies-wrongly-matching-with-template-with-wildcard-pattern/252184 "2020-10-15T11:27:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![raulgs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raulgs/32/68308_2.png) [@raulgs](https://discuss.elastic.co/u/raulgs)\
**Post date:** [October 15, 2020, 11:27am UTC](https://discuss.elastic.co/t/hidden-indicies-wrongly-matching-with-template-with-wildcard-pattern/252184/1 "2020-10-15T11:27:05Z")

</div>

Hi elastic-team,

I am currently a bit confused.  
We do have a template that looks like this:

```auto
PUT _template/denic-index-template?include_type_name
{
  "order": 100,
  "index_patterns": [
    "*"
  ],
  "settings": {
    "index": {
      "format": "1",
      "lifecycle": {
        "name": "denic-index-policy"
      },
      "number_of_shards": "1",
      "auto_expand_replicas": "0-1",
      "number_of_replicas": "1"
    }
  },
  "aliases": {},
  "mappings": {
    "_doc": {
      "_routing": {
        "required": false
      },
      "numeric_detection": false,
      "dynamic_date_formats": [
        "strict_date_optional_time",
        "yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"
      ],
      "_meta": {},
      "_source": {
        "excludes": [],
        "includes": [],
        "enabled": true
      },
      "dynamic": true,
      "date_detection": true
    }
  }
}

```

This was initially brought in place to attach our lifecycle policy to indicies that do not match with any other pattern. Problem now is that it seems to attach this policy also to hidden indicies like for example the .kibana\_x index which of course should not be touched...

So I have been looking around and was first thinking of adding a `-.kibana*` to the pattern of the above shown index template. However, then I found these two documentations: [Multi-target syntax | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-index.html#multi-index)  
[Index modules | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html#dynamic-index-settings)  
Where it says in the second:

> `index.hidden`
> 
> Indicates whether the index should be hidden by default. Hidden indices are not returned by default when using a wildcard expression. This behavior is controlled per request through the use of the `expand_wildcards` parameter. Possible values are `true` and `false` (default).

So I it is pretty clear that I am confused now...  
From what I read there I understand that normally hidden indicies should not be catched by a wildcard pattern.

Can someone please explain me what is going on? 🤔

---

<div class="post-metadata">

**Author:** ![raulgs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raulgs/32/68308_2.png) [@raulgs](https://discuss.elastic.co/u/raulgs)\
**Post date:** [October 16, 2020, 7:04pm UTC](https://discuss.elastic.co/t/hidden-indicies-wrongly-matching-with-template-with-wildcard-pattern/252184/2 "2020-10-16T19:04:37Z")

</div>

Nobody? 🙄

---

<div class="post-metadata">

**Author:** ![raulgs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raulgs/32/68308_2.png) [@raulgs](https://discuss.elastic.co/u/raulgs)\
**Post date:** [October 23, 2020, 4:31pm UTC](https://discuss.elastic.co/t/hidden-indicies-wrongly-matching-with-template-with-wildcard-pattern/252184/3 "2020-10-23T16:31:11Z")

</div>

I added the `-.*` wildcard today before running to update to 7.9.3.  
Still same `.kibana_7` has been attached to a index lifecycle policy...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2020, 4:31pm UTC](https://discuss.elastic.co/t/hidden-indicies-wrongly-matching-with-template-with-wildcard-pattern/252184/4 "2020-11-20T16:31:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.