# Problem applying index pattern

**URL:** <https://forum.opensearch.org/t/problem-applying-index-pattern/8470>\
**Category:** Index Management\
**Tags:** troubleshoot\
**Created:** [January 31, 2022, 8:54am UTC](https://forum.opensearch.org/t/problem-applying-index-pattern/8470 "2022-01-31T08:54:53Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rizvaughan](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@Rizvaughan](https://forum.opensearch.org/u/Rizvaughan)\
**Post date:** [January 31, 2022, 8:54am UTC](https://forum.opensearch.org/t/problem-applying-index-pattern/8470/1 "2022-01-31T08:54:53Z")

</div>

Edit: Removing one part about ISM policy. I figured out that I was missing an action.

I have two opensearch domains `A` and `B` managed by `aws`. `A` has fairly simple `asm policy` which is “delete all indices older than 3 weeks”. The problem is that all the indices have different names, I can’t use a wildcard like “logs\* or logs_access_”. The index pattern I have is something like “ab-cd-fg-something-something.something-2022.04 or abc-sd-something-something-2022.03”. I created an `ism_template` with the following `index_patterns`.

```auto
"index_patterns": [
                "^[a-zA-Z]+.*-[0-9]{4}.[0-9][0-9]$"
                  ]

```

But the this template is not applied to the new indices. This index pattern is ignored by opensearch. I would like to know how to make this work.  
As for `B`, the case is a little different.  
The pattern of indices is quite similar. The only thing I can think of is all the indices have `prod` in their name, either in the middle, beginning or at the end.  
But the bigger issue is I need two policies. One for two indices which have `updated` and `evaluated` string in the index name. I tried to try some regex but it seems like opensearch works with very few basic regex operations.  
I cannot create policies for each case as they are a lot and can increase in future.  
Could somone guide me with this?  
Thank you

---

<div class="post-metadata">

**Author:** ![dtaivpp](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/dtaivpp/32/2814_2.png) [@dtaivpp](https://forum.opensearch.org/u/dtaivpp)\
**Post date:** [January 31, 2022, 9:05pm UTC](https://forum.opensearch.org/t/problem-applying-index-pattern/8470/2 "2022-01-31T21:05:34Z")

</div>

Hey Rizvaughan!

I spent a good bit of time today digging and here is what I found. I believe the index patterns don’t support normal regex patterns. The index pattern field you are referencing is very similar to the ones used to create index patterns from the ‘app/management/opensearch-dashboards/indexPatterns/create’ section of OpenSearch-Dashbaords. On that page there is this little snippit:

`Use an asterisk (*) to match multiple indices. Spaces and the characters \, /, ?, ", <, >, | are not allowed.`

I believe this is the issue you are seeing right now. I have submitted an issue here and if you’d like you can submit a PR to fix this in the docs.

[https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1191](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1191)

---

<div class="post-metadata">

**Author:** ![Rizvaughan](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@Rizvaughan](https://forum.opensearch.org/u/Rizvaughan)\
**Post date:** [January 31, 2022, 9:55pm UTC](https://forum.opensearch.org/t/problem-applying-index-pattern/8470/3 "2022-01-31T21:55:17Z")

</div>

> [@dtaivpp](#):
>
> a PR to fix this in the docs

Hi @dtaivpp !  
Thank you for your comment and for your time. This is one of the few `regex` I came up with which didn’t give me the error you have mentioned above. Yes, it’s not clear at all. I am not very familiar with PR on github to be honest. If you have opened an issue, should I open another one for the same cause? Sorry it’s not the place for you to teach me how PR works but I will leave a comment on your issue.  
Thank you!

---

<div class="post-metadata">

**Author:** ![dtaivpp](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/dtaivpp/32/2814_2.png) [@dtaivpp](https://forum.opensearch.org/u/dtaivpp)\
**Post date:** [February 1, 2022, 2:58pm UTC](https://forum.opensearch.org/t/problem-applying-index-pattern/8470/4 "2022-02-01T14:58:13Z")

</div>

@Rizvaughan no need to open another! I saw your comment and that is more than enough support for us to get some headway. Also, it is 100% okay to ask about creating a PR. I have actually been thinking it might be good to create a guide that walks through the process. Let me know if that would be helpful!

---

<div class="post-metadata">

**Author:** ![Rizvaughan](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@Rizvaughan](https://forum.opensearch.org/u/Rizvaughan)\
**Post date:** [February 1, 2022, 4:03pm UTC](https://forum.opensearch.org/t/problem-applying-index-pattern/8470/5 "2022-02-01T16:03:34Z")

</div>

> [@dtaivpp](#):
>
> ow if that would be

Hi again @dtaivpp ,  
Thanks a lot yeah that would be great! Looking forward to it!  
B.R

---

<div class="post-metadata">

**Author:** ![dtaivpp](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/dtaivpp/32/2814_2.png) [@dtaivpp](https://forum.opensearch.org/u/dtaivpp)\
**Post date:** [February 4, 2022, 4:31pm UTC](https://forum.opensearch.org/t/problem-applying-index-pattern/8470/6 "2022-02-04T16:31:00Z")

</div>

Just wanted to loop you in, I just want to get one of my Java focused peers to double check and make sure the documentation is correct and we can know exactly how it’s implemented. By this I mean I am looking to see if just wildcards are supported or if it uses something like glob patterns. Thanks for your patience!

---

<div class="post-metadata">

**Author:** ![Rizvaughan](https://avatars.discourse-cdn.com/v4/letter/r/bbe5ce/32.png) [@Rizvaughan](https://forum.opensearch.org/u/Rizvaughan)\
**Post date:** [February 7, 2022, 7:59am UTC](https://forum.opensearch.org/t/problem-applying-index-pattern/8470/7 "2022-02-07T07:59:43Z")

</div>

> [@dtaivpp](#):
>
> Just wanted to loop you in, I just want to get one of my Java focused peers to double check and make sure the documentation is correct and we can know exactly how it’s implemented. By this I mean I am looking to see if just wildcards are supported or if it uses something like glob patterns. Thanks for your patience

Thank you @dtaivpp !  
Yeah it will be very helpful to know what the limitations are.  
B.R

---

<div class="post-metadata">

**Author:** ![chcnet](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@chcnet](https://forum.opensearch.org/u/chcnet)\
**Post date:** [September 21, 2023, 10:05am UTC](https://forum.opensearch.org/t/problem-applying-index-pattern/8470/8 "2023-09-21T10:05:47Z")

</div>

Hi all  
Is this yet open? I have a similar problem - I want to create a usergroup which is allowed to see just one index, not all.  
If I add to the groups index pattern anything different than “\*”, I get permission errors.

Kind regards  
Christoph
