Curator age filter with field_stats source not working

Elastic Stack Elasticsearch
1

Hi, I am using the sample data available on kibana to make some tests, but when I try to delete only 5 days older indices, all indices are deleted. Flights and eCommerce data are loaded. The elasticsearch and kibana are running on docker containers.

config file:
---
client:
hosts:
- 127.0.0.1
port: 9200
url_prefix:
use_ssl: false
certificate:
client_cert:
client_key:
ssl_no_validate: false
timeout: 30
master_only: false
http_auth: elastic:elastic

logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

actions config file:

actions:
 1:
  action: delete_indices
  description: >-
   Delete indices older than 5 days based on index name.
  options:
   ignore_empty_list: True
   timeout_override:
   continue_if_exception: False
   disable_action: False
  filters:
  - filtertype: pattern
    kind: suffix
    value: flights
  - filtertype: age
    source: field_stats
    direction: older
    unit: days
    unit_count: 5
    field: 'timestamp'
    stats_result: min_value

terminal output

2020-02-05 04:32:49,773 INFO      Preparing Action ID: 1, "delete_indices"
2020-02-05 04:32:49,773 INFO      Creating client object and testing connection
2020-02-05 04:32:49,776 INFO      Instantiating client object
2020-02-05 04:32:49,777 INFO      Testing client connectivity
2020-02-05 04:32:49,871 INFO      Successfully created Elasticsearch client object with provided settings
2020-02-05 04:32:49,875 INFO      Trying Action ID: 1, "delete_indices": Delete indices older than 5 days based on index name.
2020-02-05 04:32:49,933 INFO      Deleting 1 selected indices: ['kibana_sample_data_flights']
2020-02-05 04:32:49,935 INFO      ---deleting index kibana_sample_data_flights
2020-02-05 04:32:50,031 INFO      Action ID: 1, "delete_indices" completed.
2020-02-05 04:32:50,031 INFO      Job completed.
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.