1=== `name`-based ages
2
3Using `name` as the `source` tells Curator to look for a
4<<fe_timestring,`timestring`>> within the index or snapshot name, and convert
5that into an epoch timestamp (epoch implies UTC).
6
7[source,yaml]
8-------------
9 - filtertype: age
10   source: name
11   direction: older
12   timestring: '%Y.%m.%d'
13   unit: days
14   unit_count: 3
15-------------
16
17include::inc_timestring_regex.asciidoc[]
18
19=== `creation_date`-based ages
20
21`creation_date` extracts the epoch time of index or snapshot creation.
22
23[source,yaml]
24-------------
25 - filtertype: age
26   source: creation_date
27   direction: older
28   unit: days
29   unit_count: 3
30-------------
31
32=== `field_stats`-based ages
33
34NOTE: `source` can only be `field_stats` when filtering indices.
35
36In Curator 5.3 and older, source `field_stats` uses the
37http://www.elastic.co/guide/en/elasticsearch/reference/5.6/search-field-stats.html[Field Stats API]
38to calculate either the `min_value` or the `max_value` of the <<fe_field,`field`>>
39as the <<fe_stats_result,`stats_result`>>, and then use that value for age
40comparisons.  In 5.4 and above, even though it is still called `field_stats`, it
41uses an aggregation to calculate the same values, as the `field_stats` API is
42no longer used in Elasticsearch 6.x and up.
43
44<<fe_field,`field`>> must be of type `date` in Elasticsearch.
45
46[source,yaml]
47-------------
48 - filtertype: age
49   source: field_stats
50   direction: older
51   unit: days
52   unit_count: 3
53   field: '@timestamp'
54   stats_result: min_value
55-------------
56