thanks, I did something similar, but since I use a shrink suffix, I could also exclude by the pattern suffix rather than doing a count and sort to pick the most recent, this just grabs any logstash-<logs_index_prefix>-* indices that haven't been shrunk before and are not the one associated with the write alias.
filters:
- filtertype: alias
aliases: logs_write_alias
exclude: True
- filtertype: pattern
kind: prefix
value: logstash-logs_index_prefix-
- filtertype: pattern
kind: suffix
value: -archive
exclude: True