# Cannot delete winlogbeat indices using curator

**URL:** <https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679>\
**Category:** Elasticsearch\
**Tags:** curator\
**Created:** [August 6, 2021, 6:48pm UTC](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679 "2021-08-06T18:48:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [August 6, 2021, 6:48pm UTC](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679/1 "2021-08-06T18:48:46Z")

</div>

Hi there,

I´m trying to use curator but something is not right. Can someone try to help me??

Following the config that I have:

config.yml

```auto
client:
  hosts:
    - XX.XX.XX.XX
  port: 9200
  url_prefix:
  use_ssl: true
  certificate: '/etc/elasticsearch/certs/ca/ca.crt'
  client_cert: '/etc/elasticsearch/certs/elasticsearch.crt'
  client_key: '/etc/elasticsearch/certs/elasticsearch.key'
  ssl_no_validate: false
  username: ''
  password: ''
  timeout: 90
  master_only:
logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

```

action.yml

```auto
actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than $DELETE_AGE days (default is 7)
      for logstash and metricbeat prefixed indices.
    options:
      ignore_empty_list: True
      allow_ilm_indices: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: regex
      value: "^(winlogbeat-7.13.0-).*$"
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 5

```

One of the results of the curator\_cli:

```auto
winlogbeat-7.13.0-2021.07.30-000001
winlogbeat-7.13.0-2021.07.31-000002
winlogbeat-7.13.0-2021.08.01-000003
winlogbeat-7.13.0-2021.08.02-000004
winlogbeat-7.13.0-2021.08.03-000005
winlogbeat-7.13.0-2021.08.04-000006
winlogbeat-7.13.0-2021.08.06-000007

```

And the results:

```auto
2021-08-06 15:47:13,134 INFO Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>
2021-08-06 15:47:13,134 INFO Action ID: 1, "delete_indices" completed.
2021-08-06 15:47:13,135 INFO Job completed.

```

What I´m doing wrong??

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Glen\_Smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/glen_smith/32/111656_2.png) [@Glen\_Smith](https://discuss.elastic.co/u/Glen_Smith)\
**Post date:** [August 6, 2021, 8:35pm UTC](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679/2 "2021-08-06T20:35:48Z")

</div>

What is the behavior if you use  
`value: '^(winlogbeat-7.13.0-).*$'`  
instead of  
`value: "^(winlogbeat-7.13.0-).*$"`  
?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [August 9, 2021, 2:48pm UTC](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679/3 "2021-08-09T14:48:03Z")

</div>

> [@francescouk](#):
>
> `allow_ilm_indices: False`

I'm guessing this should be set to `true` instead. I'm pretty certain that `winlogbeat` indices will have come with an ILM policy by default, whether you use it or not.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2021, 2:48pm UTC](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679/4 "2021-09-06T14:48:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.