Curator 5.8.1 question // no output on curator logs

Elastic Stack Elasticsearch
1

Hello elastic team,
I have a problem with curator. It just stops without any error or anything after 2 secs. Both tried normal and dryrun no change.

I have 3 nodes elastic cluster running on Rhel 7.7 VMs.
ELK version 7.6.1.

I'm trying to run curator on a windows server on the same ip block. Can you tell me what i'm missing below.

My logoutput is only this 3 lines each time;
> 2020-05-24 01:27:19,432 DEBUG curator.cli run:110 Client and logging options validated.
> 2020-05-24 01:27:19,432 DEBUG curator.cli run:114 default_timeout = 30
> 2020-05-24 01:27:19,432 DEBUG curator.cli run:118 action_file: action.yml

***action.yml***
     
     actions:
      1:
         action: delete_indices
         description: >-
           My desc...
         options:
           ignore_empty_list: True
           continue_if_exception: True
           disable_action: False
         filters:
         - filtertype: pattern
           kind: regex
           value: '^csm_siem_record_(xxx|yyy|zzz|ffff)\D+(\d{1,2}_)?\d+'
         - filtertype: age
           source: name
           direction: older
           timestring: '%Y%m'
           unit: months
           unit_count: 2

***config.yml***

 client: 
   hosts:  
     - 10.214.107.13
   port: 9200
   url_prefix: 
   use_ssl: False
   certificate:  
   client_cert: 
   client_key: 
   ssl_no_validate: True
   http_auth: "elastic:xxxx"
   timeout: 30
   master_only: False

 logging: 
   loglevel: DEBUG
   logfile: 'C:\Program Files\elasticsearch-curator\logs\test.log'

Incase my indice pattern seems strange , i have like 1.5k indices with this format.
So i regexed it.

csm_siem_record_xxxx_2_202005
csm_siem_record_yyyy_4_202005
csm_siem_record_zzzz202005
csm_siem_record_fffff202005
csm_siem_record_gggg202002

I can try with unix environment as a cronjob , if it's about environment.

Best Regards ET

2

Hey there, you can close the topic.
I made it work btw.

Problem is windows not accepting , JSON format you have to escape inner quotes with \ escape character before them. Another problem is even regex is quite working. curator config doesn't except some regex params like \D+ which i used for non digit chars. Tried with both curator and curator_cli.

I had to move greedy as it saved my case.
"^csm_siem_record_(xxx|yyy|zzz|ffff).*"

Deep note:
as i keep adding actions , it may be torture so running from unix now with RPM install.

Best Regards ET...

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.