Using Curator to reindex multiple dailies into a single daily?

[rj-reilly]

Hi, I have 5 indexes created daily, on the following day I would like to combine them into a single index using curator. I am not sure on how to setup the filter to only do based on name and date for just the one day.
i.e
data-066223-2019.02.05
data-342434-2019.02.05
data-980973-2019.02.05
data-450234-2019.02.05
data-963237-2019.02.05

then after midnight reindex to data-2019.02.05
thanks !
rob

[theuntergeek (Aaron Mildenstein)]

My first question is why they are in separate indices in the first place, if you're planning on re-joining them?

[rj-reilly]

for now that is out of my control, the app team needs to make the change and I am just trying to reduce the number of shards/indexes in the cluster to keep it managable.

[theuntergeek (Aaron Mildenstein)]

Gotcha.

- filtertype: pattern
  kind: regex
  value: '^data-\d{6}-\d{4}\.\d{2}\.\d{2}$'
- filtertype: period
  period_type: relative
  source: name
  range_from: -1
  range_to: -1
  timestring: '%Y.%m.%d'
  unit: days

If you run this after UTC midnight, these two filters should find all indices matching data-(6 digits)-(4 digits).(2 digits).(2 digits) that were were created the previous day.

You can test/verify this by using --dry-run.

The target index would have to be named <data-{now/d-1d}>, as you want it to have yesterday's date on it.