https://github.com/openshift/origin-aggregated-logging/pull/911

@josef, PR still not merged to the latest logging-curator-v3.7.36-1

sh-4.2$ diff /opt/app-root/src/run_cron.py /tmp/run_cron.py    
103c103,107
< default_command = base_default_cmd + ' --older-than ' + str(default_value) + ' --time-unit ' + default_time_unit + ' --exclude .searchguard* --exclude .kibana*'
---
> default_command = base_default_cmd \
>         + ' --older-than ' + str(default_value) \
>         + ' --time-unit ' + default_time_unit \
>         + ' --exclude ' + shellquote('^' + re.escape('.searchguard.') + '.*$') \
>         + ' --exclude ' + shellquote('^' + re.escape('.kibana.') + '.*$')
116,117d119
<                     default_command = default_command + " --exclude " + shellquote(re.escape(project + '.') + '*')
< 
125a128,129
>                     default_command = default_command \
>                             + " --exclude " + shellquote('^' + re.escape(this_project + '.') + '.*$')
151c155
<                 lambda project:'^' + re.escape(project + '.'),
---
>                 lambda project:'^' + re.escape(project + '.') + '.*$',

[root@ip-172-18-1-175 ~]# oc get configmap logging-curator -o yaml
apiVersion: v1
data:
  config.yaml: |
    .defaults:
      delete:
        days: 30
      runhour: 0
      runminute: 0

    .operations:
      delete:
        weeks: 8

    myapp:
      delete:
        weeks: 1

    .regex:
    - pattern: '^project\..+\-dev\..*$'
      delete:
        days: 15
    - pattern: '^project\..+\-test\..*$'
      delete:
        days: 30


# oc logs logging-curator-2-kxnkd
The project name must match this regex: [^[a-z0-9]([-a-z0-9]*[a-z0-9])?$] This does not match: [.regex]

The previous build did not have the latest code, let's wait for another one

Verified with openshift3/logging-curator/images/v3.7.39-1

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0636