Curator 4.x error unable to complete action

Elastic Stack Elasticsearch
1

Hi, just installed curator 4.x but when run I get an error:

[root@elk01 curator]# curator --dry-run --config /etc/curator/config.yml /etc/curator/close.yml
2016-08-04 10:13:58,583 INFO Action #1: close
2016-08-04 10:13:58,637 ERROR Unable to complete action "close". No actionable items in list: <class 'curator.exceptions.NoIndices'>
[root@elk01 curator]#

I have all my config and action files in /etc/curator/*

Extract of my config file:

[root@elk01 curator]# cat config.yml
client:
hosts:
- elk01
port: 9200
url_prefix:
use_ssl: False
certificate:
client_cert:
client_key:
aws_key:
aws_secret_key:
aws_region:
ssl_no_validate: False
http_auth:
timeout: 30
master_only: False

logging:
loglevel: INFO
logfile:
logformat: default
blacklist: ['elasticsearch', 'urllib3']
[root@elk01 curator]#

Extract of my close.yml file:

[root@elk01 curator]# cat close.yml
actions:
1:
action: close
description: >-
Close indices older than 2 days (based on index name), for logstash-
prefixed indices.
options:
delete_aliases: False
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: logstash-
exclude:
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 2
exclude:
[root@elk01 curator]#

Any ideas?

2

Without more to go on, it would suggest:

  1. You have no open logstash-* indices older than 2 days (they've already been closed)
  2. You have no logstash-* indices older than 2 days.

Try running with loglevel set to DEBUG. You'll see what's going on under the hood.

3

Ahh thanks!
I removed logstash- and changed it to topbeat- and that worked nicely.
How/what value should I put there f I want to close topbeat, filebeat and a heap of other index's

Thanks.

4

All good!
worked it out :slight_smile:

Extract of my close.yml in particular 'kind' and value.

1:
action: close
description: >-
Close indices older than 10 days (based on index name), for logstash-
prefixed indices.
options:
delete_aliases: False
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: timestring
value: '%Y.%m.%d'
exclude:
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 10
exclude:

Thanks for pointing it out Aaron.