Filter Methods

IndexList

IndexList.filter_allocated(key=None, value=None, allocation_type='require', exclude=True)

Match indices that have the routing allocation rule of key=value from indices

Parameters:
  • key – The allocation attribute to check for
  • value – The value to check for
  • allocation_type – Type of allocation to apply
  • exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is True
IndexList.filter_by_age(source='name', direction=None, timestring=None, unit=None, unit_count=None, field=None, stats_result='min_value', epoch=None, exclude=False, unit_count_pattern=False)

Match indices by relative age calculations.

Parameters:
  • source – Source of index age. Can be one of ‘name’, ‘creation_date’, or ‘field_stats’
  • direction – Time to filter, either older or younger
  • timestring – An strftime string to match the datestamp in an index name. Only used for index filtering by name.
  • unit – One of seconds, minutes, hours, days, weeks, months, or years.
  • unit_count – The number of unit (s). unit_count * unit will be calculated out to the relative number of seconds.
  • unit_count_pattern – A regular expression whose capture group identifies the value for unit_count.
  • field – A timestamp field name. Only used for field_stats based calculations.
  • stats_result – Either min_value or max_value. Only used in conjunction with source`=``field_stats` to choose whether to reference the minimum or maximum result value.
  • epoch – An epoch timestamp used in conjunction with unit and unit_count to establish a point of reference for calculations. If not provided, the current time will be used.
  • exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is False
IndexList.filter_by_regex(kind=None, value=None, exclude=False)

Match indices by regular expression (pattern).

Parameters:
  • kind – Can be one of: suffix, prefix, regex, or timestring. This option defines what kind of filter you will be building.
  • value – Depends on kind. It is the strftime string if kind is timestring. It’s used to build the regular expression for other kinds.
  • exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is False
IndexList.filter_by_space(disk_space=None, reverse=True, use_age=False, source='creation_date', timestring=None, field=None, stats_result='min_value', exclude=False)

Remove indices from the actionable list based on space consumed, sorted reverse-alphabetically by default. If you set reverse to False, it will be sorted alphabetically.

The default is usually what you will want. If only one kind of index is provided–for example, indices matching logstash-%Y.%m.%d–then reverse alphabetical sorting will mean the oldest will remain in the list, because lower numbers in the dates mean older indices.

By setting reverse to False, then index3 will be deleted before index2, which will be deleted before index1

use_age allows ordering indices by age. Age is determined by the index creation date by default, but you can specify an source of name, max_value, or min_value. The name source requires the timestring argument.

Parameters:
  • disk_space – Filter indices over n gigabytes
  • reverse – The filtering direction. (default: True). Ignored if use_age is True
  • use_age – Sort indices by age. source is required in this case.
  • source – Source of index age. Can be one of name, creation_date, or field_stats. Default: creation_date
  • timestring – An strftime string to match the datestamp in an index name. Only used if source name is selected.
  • field – A timestamp field name. Only used if source field_stats is selected.
  • stats_result – Either min_value or max_value. Only used if source field_stats is selected. It determines whether to reference the minimum or maximum value of field in each index.
  • exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is False
IndexList.filter_closed(exclude=True)

Filter out closed indices from indices

Parameters:exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is True
IndexList.filter_forceMerged(max_num_segments=None, exclude=True)

Match any index which has max_num_segments per shard or fewer in the actionable list.

Parameters:
  • max_num_segments – Cutoff number of segments per shard.
  • exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is True
IndexList.filter_kibana(exclude=True)

Match any index named .kibana, kibana-int, .marvel-kibana, or .marvel-es-data in indices.

Parameters:exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is True
IndexList.filter_opened(exclude=True)

Filter out opened indices from indices

Parameters:exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is True
IndexList.filter_none()
IndexList.filter_by_alias(aliases=None, exclude=False)

Match indices which are associated with the alias or list of aliases identified by aliases.

An update to Elasticsearch 5.5.0 changes the behavior of this from previous 5.x versions: https://www.elastic.co/guide/en/elasticsearch/reference/5.5/breaking-changes-5.5.html#breaking_55_rest_changes

What this means is that indices must appear in all aliases in list aliases or a 404 error will result, leading to no indices being matched. In older versions, if the index was associated with even one of the aliases in aliases, it would result in a match.

It is unknown if this behavior affects anyone. At the time this was written, no users have been bit by this. The code could be adapted to manually loop if the previous behavior is desired. But if no users complain, this will become the accepted/expected behavior.

Parameters:
  • aliases (list) – A list of alias names.
  • exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is False
IndexList.filter_by_count(count=None, reverse=True, use_age=False, source='creation_date', timestring=None, field=None, stats_result='min_value', exclude=True)

Remove indices from the actionable list beyond the number count, sorted reverse-alphabetically by default. If you set reverse to False, it will be sorted alphabetically.

The default is usually what you will want. If only one kind of index is provided–for example, indices matching logstash-%Y.%m.%d–then reverse alphabetical sorting will mean the oldest will remain in the list, because lower numbers in the dates mean older indices.

By setting reverse to False, then index3 will be deleted before index2, which will be deleted before index1

use_age allows ordering indices by age. Age is determined by the index creation date by default, but you can specify an source of name, max_value, or min_value. The name source requires the timestring argument.

Parameters:
  • count – Filter indices beyond count.
  • reverse – The filtering direction. (default: True).
  • use_age – Sort indices by age. source is required in this case.
  • source – Source of index age. Can be one of name, creation_date, or field_stats. Default: creation_date
  • timestring – An strftime string to match the datestamp in an index name. Only used if source name is selected.
  • field – A timestamp field name. Only used if source field_stats is selected.
  • stats_result – Either min_value or max_value. Only used if source field_stats is selected. It determines whether to reference the minimum or maximum value of field in each index.
  • exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is True
IndexList.filter_period(source='name', range_from=None, range_to=None, timestring=None, unit=None, field=None, stats_result='min_value', week_starts_on='sunday', epoch=None, exclude=False)

Match indices within ages within a given period.

Parameters:
  • source – Source of index age. Can be one of ‘name’, ‘creation_date’, or ‘field_stats’
  • range_from – How many unit (s) in the past/future is the origin?
  • range_to – How many unit (s) in the past/future is the end point?
  • timestring – An strftime string to match the datestamp in an index name. Only used for index filtering by name.
  • unit – One of hours, days, weeks, months, or years.
  • unit_count – The number of unit (s). unit_count * unit will be calculated out to the relative number of seconds.
  • field – A timestamp field name. Only used for field_stats based calculations.
  • stats_result – Either min_value or max_value. Only used in conjunction with source`=``field_stats` to choose whether to reference the minimum or maximum result value.
  • week_starts_on – Either sunday or monday. Default is sunday
  • epoch – An epoch timestamp used to establish a point of reference for calculations. If not provided, the current time will be used.
  • exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is False

SnapshotList

SnapshotList.filter_by_age(source='creation_date', direction=None, timestring=None, unit=None, unit_count=None, epoch=None, exclude=False)

Remove snapshots from snapshots by relative age calculations.

Parameters:
  • source – Source of snapshot age. Can be ‘name’, or ‘creation_date’.
  • direction – Time to filter, either older or younger
  • timestring – An strftime string to match the datestamp in an snapshot name. Only used for snapshot filtering by name.
  • unit – One of seconds, minutes, hours, days, weeks, months, or years.
  • unit_count – The number of unit (s). unit_count * unit will be calculated out to the relative number of seconds.
  • epoch – An epoch timestamp used in conjunction with unit and unit_count to establish a point of reference for calculations. If not provided, the current time will be used.
  • exclude – If exclude is True, this filter will remove matching snapshots from snapshots. If exclude is False, then only matching snapshots will be kept in snapshots. Default is False
SnapshotList.filter_by_regex(kind=None, value=None, exclude=False)

Filter out snapshots not matching the pattern, or in the case of exclude, filter those matching the pattern.

Parameters:
  • kind – Can be one of: suffix, prefix, regex, or timestring. This option defines what kind of filter you will be building.
  • value – Depends on kind. It is the strftime string if kind is timestring. It’s used to build the regular expression for other kinds.
  • exclude – If exclude is True, this filter will remove matching snapshots from snapshots. If exclude is False, then only matching snapshots will be kept in snapshots. Default is False
SnapshotList.filter_by_state(state=None, exclude=False)

Filter out snapshots not matching state, or in the case of exclude, filter those matching state.

Parameters:
  • state – The snapshot state to filter for. Must be one of SUCCESS, PARTIAL, FAILED, or IN_PROGRESS.
  • exclude – If exclude is True, this filter will remove matching snapshots from snapshots. If exclude is False, then only matching snapshots will be kept in snapshots. Default is False
SnapshotList.filter_none()
SnapshotList.filter_by_count(count=None, reverse=True, use_age=False, source='creation_date', timestring=None, exclude=True)

Remove snapshots from the actionable list beyond the number count, sorted reverse-alphabetically by default. If you set reverse to False, it will be sorted alphabetically.

The default is usually what you will want. If only one kind of snapshot is provided–for example, snapshots matching curator-%Y%m%d%H%M%S– then reverse alphabetical sorting will mean the oldest will remain in the list, because lower numbers in the dates mean older snapshots.

By setting reverse to False, then snapshot3 will be acted on before snapshot2, which will be acted on before snapshot1

use_age allows ordering snapshots by age. Age is determined by the snapshot creation date (as identified by start_time_in_millis) by default, but you can also specify a source of name. The name source requires the timestring argument.

Parameters:
  • count – Filter snapshots beyond count.
  • reverse – The filtering direction. (default: True).
  • use_age – Sort snapshots by age. source is required in this case.
  • source – Source of snapshot age. Can be one of name, or creation_date. Default: creation_date
  • timestring – An strftime string to match the datestamp in a snapshot name. Only used if source name is selected.
  • exclude – If exclude is True, this filter will remove matching snapshots from snapshots. If exclude is False, then only matching snapshots will be kept in snapshots. Default is True
SnapshotList.filter_period(source='name', range_from=None, range_to=None, timestring=None, unit=None, field=None, stats_result='min_value', week_starts_on='sunday', epoch=None, exclude=False)

Match indices within ages within a given period.

Parameters:
  • source – Source of snapshot age. Can be ‘name’, or ‘creation_date’.
  • range_from – How many unit (s) in the past/future is the origin?
  • range_to – How many unit (s) in the past/future is the end point?
  • timestring – An strftime string to match the datestamp in an snapshot name. Only used for snapshot filtering by name.
  • unit – One of hours, days, weeks, months, or years.
  • week_starts_on – Either sunday or monday. Default is sunday
  • epoch – An epoch timestamp used to establish a point of reference for calculations. If not provided, the current time will be used.
  • exclude – If exclude is True, this filter will remove matching indices from indices. If exclude is False, then only matching indices will be kept in indices. Default is False