Cannot delete winlogbeat indices using curator

Elastic Stack Elasticsearch
1

Hi there,

I´m trying to use curator but something is not right. Can someone try to help me??

Following the config that I have:

config.yml

client:
  hosts:
    - XX.XX.XX.XX
  port: 9200
  url_prefix:
  use_ssl: true
  certificate: '/etc/elasticsearch/certs/ca/ca.crt'
  client_cert: '/etc/elasticsearch/certs/elasticsearch.crt'
  client_key: '/etc/elasticsearch/certs/elasticsearch.key'
  ssl_no_validate: false
  username: ''
  password: ''
  timeout: 90
  master_only:
logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

action.yml

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than $DELETE_AGE days (default is 7)
      for logstash and metricbeat prefixed indices.
    options:
      ignore_empty_list: True
      allow_ilm_indices: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: regex
      value: "^(winlogbeat-7.13.0-).*$"
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 5

One of the results of the curator_cli:

winlogbeat-7.13.0-2021.07.30-000001
winlogbeat-7.13.0-2021.07.31-000002
winlogbeat-7.13.0-2021.08.01-000003
winlogbeat-7.13.0-2021.08.02-000004
winlogbeat-7.13.0-2021.08.03-000005
winlogbeat-7.13.0-2021.08.04-000006
winlogbeat-7.13.0-2021.08.06-000007

And the results:

2021-08-06 15:47:13,134 INFO      Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>
2021-08-06 15:47:13,134 INFO      Action ID: 1, "delete_indices" completed.
2021-08-06 15:47:13,135 INFO      Job completed.

What I´m doing wrong??

Thanks in advance

2

What is the behavior if you use
value: '^(winlogbeat-7.13.0-).*$'
instead of
value: "^(winlogbeat-7.13.0-).*$"
?

3

I'm guessing this should be set to true instead. I'm pretty certain that winlogbeat indices will have come with an ILM policy by default, whether you use it or not.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.