Curator Alias Add not working if Remove list is empty

Elastic Stack Elasticsearch
1

Hi All

I was just wondering if you could help me with something and whether this is the intended behaviour of Curator or not... I am currently setting up a number of automated alias actions in Curator, for things like "today", "yesterday", "last 7 days" etc etc and have come across an odd potential issue...

When testing my "Last 7 Days" function, it is set up as the following:

action: alias
    description: >-
      Add relevant event indexes to a "Last 7 Days" alias for rapid searching etc
    options:
      name: events_last_7
      extra_settings:
      timeout_override:
      ignore_empty_list: True
      continue_if_exception: False
      disable_action: False
    add:
      filters:
      - filtertype: pattern
        kind: prefix
        value: event-
        exclude:
      - filtertype: age
        source: name
        direction: younger
        timestring: '%Y.%m.%d'
        unit: days
        unit_count: 7
        exclude:
    remove:
      filters:
      - filtertype: pattern
        kind: prefix
        value: event-
        exclude:
      - filtertype: age
        source: name
        direction: younger
        timestring: '%Y.%m.%d'
        unit: days
        unit_count: 7
        exclude: True

The problem I am having is, if I comment out the remove section it works fine (I only have 4 indexes as I'm testing which are dated over the last 4 days) but if I put the remove section in - because there are no indexes older than 7 days, it seems to return an empty list and fail the whole action?

I would expect the add action to complete successfully and the remove one to do nothing - or does it simply see the whole lot as one action which fails if one element of it fails?

2

It is atomic. Both are processed at once, so yes, currently, if one of add or remove is present but empty, that would result in an error.

If you want them performed serially, you would need to have 2 separate actions, one with an add, the other with the remove.

In contemplating whether it is wise to treat an "empty" add or remove as an indicator to remove that action from the final atomic call, I'm not sure. I can see benefits and drawbacks to this. What are your thoughts?

3

Okay, I figured that may be the case - creating separate actions for add and remove - although in that case, I wonder why the options exist to have them together in the first place? Perhaps it would be less confusing if you could either have add or remove? Alternatively, the Alias action could no longer be atomic so it runs sequentially maybe?

Anyway, I'll create individual actions for add and remove and we can go from there - perhaps I can split the config files this way which may make management easier?

Thanks for the reply :slight_smile:

4

Your current use case will only exist for at most 8 days. After that, the atomic operation you started with won't be a problem.

I'll look at pruning an operation that doesn't have any indices.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.