anchor.diff:                    1:
                       action: delete_indices
                       description: >-
  -                      Delete indices older than 1 minute (based on index name), for logstash-
  +                      Delete indices older than 1 second (based on index name), for logstash-
                         prefixed indices. Ignore the error if the filter does not result in an
                         actionable list of indices (ignore_empty_list) and exit cleanly.
                       options:
  
positive.code:                       source: name
                        direction: older
                        timestring: '%Y.%m.%d'
                        unit: minutes
                        unit_count: 1
                  '';
                };
  
negative.code:       # See if logstash messages arive in elasticsearch.
        $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"flowers\"}}}' | jq .hits.total | grep -v 0");
        $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"dragons\"}}}' | jq .hits.total | grep 0");
  
        # Test elasticsearch-curator.
        $one->systemctl("stop logstash");
        $one->systemctl("start elasticsearch-curator");
        $one->waitUntilSucceeds("! curl --silent --show-error '${esUrl}/_cat/indices' | grep logstash | grep -q ^$1");
  