1=== `name`-based ages 2 3Using `name` as the `source` tells Curator to look for a 4<<fe_timestring,`timestring`>> within the index or snapshot name, and convert 5that into an epoch timestamp (epoch implies UTC). 6 7[source,yaml] 8------------- 9 - filtertype: age 10 source: name 11 direction: older 12 timestring: '%Y.%m.%d' 13 unit: days 14 unit_count: 3 15------------- 16 17include::inc_timestring_regex.asciidoc[] 18 19=== `creation_date`-based ages 20 21`creation_date` extracts the epoch time of index or snapshot creation. 22 23[source,yaml] 24------------- 25 - filtertype: age 26 source: creation_date 27 direction: older 28 unit: days 29 unit_count: 3 30------------- 31 32=== `field_stats`-based ages 33 34NOTE: `source` can only be `field_stats` when filtering indices. 35 36In Curator 5.3 and older, source `field_stats` uses the 37http://www.elastic.co/guide/en/elasticsearch/reference/5.6/search-field-stats.html[Field Stats API] 38to calculate either the `min_value` or the `max_value` of the <<fe_field,`field`>> 39as the <<fe_stats_result,`stats_result`>>, and then use that value for age 40comparisons. In 5.4 and above, even though it is still called `field_stats`, it 41uses an aggregation to calculate the same values, as the `field_stats` API is 42no longer used in Elasticsearch 6.x and up. 43 44<<fe_field,`field`>> must be of type `date` in Elasticsearch. 45 46[source,yaml] 47------------- 48 - filtertype: age 49 source: field_stats 50 direction: older 51 unit: days 52 unit_count: 3 53 field: '@timestamp' 54 stats_result: min_value 55------------- 56