Creating a snapshot of indices created with alias

Elastic Stack Elasticsearch
1

I am using curator to create snapshots of my indices. I am also rolling over my indices with the rollover API. Here is what my index looks like when creating and rolling over.

audit-2018.05.14-1
audit-2018.05.14-000002

Here is my config file for the curator:

actions:
  1:
    action: snapshot
    description: >-
      Snapshot log-production- prefixed indices older than 1 day (based on index
      creation_date) with the default snapshot name pattern of
      'curator-%Y%m%d%H%M%S'.  Wait for the snapshot to complete.  Do not skip
      the repository filesystem access check.  Use the other options to create
      the snapshot.
    options:
      repository: data_backup

    # Leaving name blank will result in the default 'curator-%Y%m%d%H%M%S'
      name: testlogs-%Y%m%d%H%M%S
      ignore_unavailable: False
      include_global_state: True
      partial: False
      wait_for_completion: True
      skip_repo_fs_check: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: audit-
      #value: benchmark-
    - filtertype: age
      source: creation_date
      timestring: '^.*\d{4}\.\d{2}.\d{2}'
      direction: older
      unit: days
      unit_count: 1

Curator throws a error everytime saying it cant fin any indices. I know the problem is the timestring added because the index
audit-2018.05.14
works fine and it finds the index.

I have tried adding a timestring to match the other format but it is not catching it.

Thank you for any help

2

timestring is not used unless you set source: name. This would not do anything.

    - filtertype: age
      source: creation_date
      direction: older
      unit: hours
      unit_count: 1

I suggest using the above block with --dry-run set on the command-line and see if it finds indices.
With loglevel: DEBUG in your config file, you can run with --dry-run and see the timestamp values of creation_date and be able to see what age the indices actually are.

1 Like
3

Bingo. Knew I was missing something small.

Thanks a ton, Aaron

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.