Curator 5.6.0 deletes indices newer than unit_count

Elastic Stack Elasticsearch
1

Elastic Stack version: 6.2.3
Curator Version : 5.6.0

We have configured curator to delete the indices which are older than 14 days where indices are rolled on daily basis.
The configuration looks like:

    action: delete_indices
    description: "Delete \"security\" indices older than 14 days,(ignore_empty_list) and exit cleanly."
    filters: 
      - 
        exclude: ~
        filtertype: pattern
        kind: prefix
        value: security
      - 
        direction: older
        exclude: ~
        filtertype: age
        source: name
        timestring: "%Y.%m.%d"
        unit: days
        unit_count: 14
    options: 
      continue_if_exception: false
      disable_action: false
      ignore_empty_list: true
      timeout_override: ~

However, it has been noticed several times that curator is also deleting the newer indices.
For 24th June midnight run, the output was:

2019-06-25 00:04:46,739 INFO      Trying Action ID: 15, "delete_indices": Delete "security" indices older than 14 days,(ignore_empty_list) and exit cleanly.
--
  | 2019-06-25 00:04:58,935 INFO      Deleting selected indices: [u'security-logging.ec2.2019.06.10', u'security-logging.ec2.2019.06.11', u'security-logging.ec2.2019.06.09', u'security-logging.ec2.2019.06.08', u'security-logging.ec2.2018.06.22', u'security-logging.ec2.2018.06.23', u'security-logging.ec2.2018.06.21', u'security-logging.ec2.2018.06.24', u'security-logging.ec2.2018.06.25']
  | 2019-06-25 00:04:58,935 INFO      ---deleting index security-logging.ec2.2019.06.10
  | 2019-06-25 00:04:58,936 INFO      ---deleting index security-logging.ec2.2019.06.11
  | 2019-06-25 00:04:58,936 INFO      ---deleting index security-logging.ec2.2019.06.09
  | 2019-06-25 00:04:58,936 INFO      ---deleting index security-logging.ec2.2019.06.08
  | 2019-06-25 00:04:58,936 INFO      ---deleting index security-logging.ec2.2018.06.22
  | 2019-06-25 00:04:58,936 INFO      ---deleting index security-logging.ec2.2018.06.23
  | 2019-06-25 00:04:58,936 INFO      ---deleting index security-logging.ec2.2018.06.21
  | 2019-06-25 00:04:58,936 INFO      ---deleting index security-logging.ec2.2018.06.24
  | 2019-06-25 00:04:58,936 INFO      ---deleting index security-logging.ec2.2018.06.25
  | 2019-06-25 00:05:01,089 INFO      Action ID: 15, "delete_indices" completed.
  | 2019-06-25 00:05:01,089 INFO      Job completed.
2

Please run with --dry-run and with loglevel: DEBUG set. With these, it won't delete anything, but it will show you how Curator made decisions (in this case, the math comparisons that lead to which indices are selected).

Please paste the relevant output here.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.