# Kibana index patterns and date math

**URL:** <https://discuss.elastic.co/t/kibana-index-patterns-and-date-math/127968>\
**Category:** Kibana\
**Created:** [April 13, 2018, 11:57am UTC](https://discuss.elastic.co/t/kibana-index-patterns-and-date-math/127968 "2018-04-13T11:57:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrkita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrkita/32/29978_2.png) [@mrkita](https://discuss.elastic.co/u/mrkita)\
**Post date:** [April 13, 2018, 11:57am UTC](https://discuss.elastic.co/t/kibana-index-patterns-and-date-math/127968/1 "2018-04-13T11:57:50Z")

</div>

Maybe it's already possible, but it doesn't seem so to me.

I want to create an index pattern in Kibana that slices my elastic search data to the last X number of days (something like the last 3). I know that I can create aliases in elastic search, but as far as I can tell they are static at the time of creation and don't directly support "date math" (as defined here: [https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html)).

As far as I can tell the kibana "create pattern index" tool does not allow anything other than a wild card character (no date math), which means my indices (which contain a day based time stamp) could at most be limited to a specific month, and even then I would have to create a new pattern for each month, and then update all my views and visualizations to reference the new data. Plus a month is way more data than I need.

Is there another option here? Or is that a potential feature request? It does make a big difference in performance on resource limited machines (see my other post about the raspberry pi).

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 13, 2018, 12:15pm UTC](https://discuss.elastic.co/t/kibana-index-patterns-and-date-math/127968/2 "2018-04-13T12:15:42Z")

</div>

Could you not add an alias with a filtered query to your template like this:

```auto
PUT _template/test
{
  "index_patterns" : ["test-*"],
  "aliases" : {
    "last_3_days" : {
      "filter" : {
        "range": { "@timestamp": { "gte": "now-3d" } }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![mrkita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrkita/32/29978_2.png) [@mrkita](https://discuss.elastic.co/u/mrkita)\
**Post date:** [April 13, 2018, 6:15pm UTC](https://discuss.elastic.co/t/kibana-index-patterns-and-date-math/127968/3 "2018-04-13T18:15:50Z")

</div>

Ok I didn't understand the "template" concept at the time I first read this. Thank you for the suggestion, and that is in the right direction, but if I understand index templates and aliases correctly, then this will not automatically remove indices that have been added previously but are now outside this 3 days window? In other words this only takes care of autoadding new indexed date to the alias, but cleanup must be done manually?

EDIT:  
After writing my last edit... by random google chance I learned about "Elasticsearch Curator". After doing my own integration with my docker environment and tweaking it a bit, I was easily able to get exactly this behavior with the curator. Why is this thing not a standard part of the officially support ELK-Docker-Stack, it's exceptionally helpful!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2018, 6:16pm UTC](https://discuss.elastic.co/t/kibana-index-patterns-and-date-math/127968/4 "2018-05-11T18:16:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.