Matching the minion id

Each minion needs a unique identifier. By default when a minion starts for the first time it chooses its FQDN as that identifier. The minion id can be overridden via the minion's id configuration setting.


minion id and minion keys

The minion id is used to generate the minion's public/private keys and if it ever changes the master must then accept the new key as though the minion was a new host.


The default matching that Salt utilizes is shell-style globbing around the minion id. This also works for states in the top file.


You must wrap salt calls that use globbing in single-quotes to prevent the shell from expanding the globs before Salt is invoked.

Match all minions:

salt '*'

Match all minions in the domain or any of the example domains:

salt '*'
salt '*.example.*'

Match all the webN minions in the domain (,

salt 'web?'

Match the web1 through web5 minions:

salt 'web[1-5]'

Match the web1 and web3 minions:

salt 'web[1,3]'

Match the web-x, web-y, and web-z minions:

salt 'web-[x-z]'


For additional targeting methods please review the compound matchers documentation.

Regular Expressions

Minions can be matched using Perl-compatible regular expressions (which is globbing on steroids and a ton of caffeine).

Match both web1-prod and web1-devel minions:

salt -E 'web1-(prod|devel)'

When using regular expressions in a State's top file, you must specify the matcher as the first option. The following example executes the contents of webserver.sls on the above-mentioned minions.

  - match: pcre
  - webserver


At the most basic level, you can specify a flat list of minion IDs:

salt -L 'web1,web2,web3'