From 2da8f57ecc12a16d6786c8c226a9cb59fc639918 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Krze=C5=9Bniak?= Date: Fri, 2 Feb 2024 16:51:48 +0100 Subject: [PATCH] [docs] clarification on prefix and suffix kinds (#1558) Clarify that values of `prefix` and `suffix` filter kinds are not taken literally but rather a regexp is constructed from them. This is important difference if index names are using dots (or other special characters). For example, with prefix of `value: project.prod-a.` the index `project.prod-admin-portal.2020.10.15` is matched. By reading the documentation this is unexpected as the impression is that prefix and suffix should be used literally. --- docs/asciidoc/inc_kinds.asciidoc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/asciidoc/inc_kinds.asciidoc b/docs/asciidoc/inc_kinds.asciidoc index 188991c17..f9a8fcd64 100644 --- a/docs/asciidoc/inc_kinds.asciidoc +++ b/docs/asciidoc/inc_kinds.asciidoc @@ -21,6 +21,8 @@ To match all indices _except_ those starting with `logstash-`: exclude: True ------------- +Note: Internally _regex_ pattern is constructed from prefix value as `^{0}.*$`. Special characters should be escaped with backslash to match literally. + === suffix To match all indices ending with `-prod`: @@ -42,6 +44,8 @@ To match all indices _except_ those ending with `-prod`: exclude: True ------------- +Note: Internally _regex_ pattern is constructed from suffix value as `^.*{0}$`. Specials character should be escaped with backslash to match literally. + === timestring IMPORTANT: No age calculation takes place here. It is strictly a pattern match.