Skip to content

Commit

Permalink
[docs] clarification on prefix and suffix kinds (#1558)
Browse files Browse the repository at this point in the history
Clarify that values of `prefix` and `suffix` filter kinds are not taken literally but rather a regexp is constructed from them.
This is important difference if index names are using dots (or other special characters).
For example, with  prefix of `value: project.prod-a.` the index `project.prod-admin-portal.2020.10.15` is matched. By reading the documentation this is unexpected as the impression is that prefix and suffix should be used literally.
  • Loading branch information
immon authored and untergeek committed Feb 2, 2024
1 parent df69eca commit 588be1d
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions docs/asciidoc/inc_kinds.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ To match all indices _except_ those starting with `logstash-`:
exclude: True
-------------

Note: Internally _regex_ pattern is constructed from prefix value as `^{0}.*$`. Special characters should be escaped with backslash to match literally.

=== suffix

To match all indices ending with `-prod`:
Expand All @@ -42,6 +44,8 @@ To match all indices _except_ those ending with `-prod`:
exclude: True
-------------

Note: Internally _regex_ pattern is constructed from suffix value as `^.*{0}$`. Specials character should be escaped with backslash to match literally.

=== timestring

IMPORTANT: No age calculation takes place here. It is strictly a pattern match.
Expand Down

0 comments on commit 588be1d

Please sign in to comment.