anchor.diff:                        source: name
                         direction: older
                         timestring: '%Y.%m.%d'
  -                      unit: minutes
  +                      unit: seconds
                         unit_count: 1
                   '';
                 };
  
positive.code:                   1:
                      action: delete_indices
                      description: >-
                        Delete indices older than 1 minute (based on index name), for logstash-
                        prefixed indices. Ignore the error if the filter does not result in an
                        actionable list of indices (ignore_empty_list) and exit cleanly.
                      options:
  
negative.code:       # See if logstash messages arive in elasticsearch.
        $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"flowers\"}}}' | jq .hits.total | grep -v 0");
        $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"dragons\"}}}' | jq .hits.total | grep 0");
  
        # Test elasticsearch-curator.
        $one->systemctl("stop logstash");
        $one->systemctl("start elasticsearch-curator");
        $one->waitUntilSucceeds("! curl --silent --show-error '${esUrl}/_cat/indices' | grep logstash | grep -q ^$1");
  