Curator and ELK 5.4

Elastic Stack Elasticsearch
1

Hi,

I have installed curator via RPM package on CentOS 7. I run Elasticsearch 5.4. I want to run curator on it to delete old indices.

I have 2 files created. I hope they are correct:

ctaction.yml

actions:
1:
action: delete_indices
options:
ignore_empty_list: True
disable_action: False
filters:

  • filtertype: pattern
    kind: prefix
    value: logstash-
  • filtertype: age
    source: name
    direction: older
    timestring: '%Y.%m.%d'
    unit: days
    unit_count: 3

ctcurator.yml

client:
hosts:

  • 127.0.0.1
    port: 9200
    url_prefix:
    use_ssl: False
    certificate:
    client_cert:
    client_key:
    ssl_no_validate: False
    http_auth:
    timeout: 30
    master_only: False

logging:
loglevel: INFO
logfile: /var/log/curator.log
logformat: default
blacklist: ['elasticsearch', 'urllib3']

I use the following command for test:

/usr/bin/curator --config /etc/curator/ctcurator.yml /etc/curator/ctaction.yml --dry-run

Error:

Configuration: filters: Location: Action ID "1", action "delete_indices", "filte rs": Bad Value: "None", 0. Check configuration file.

Can someone help me?

2

I can't tell whether the files are properly indented, or have spaces between lines, or any other number of things which could cause invalid YAML syntax.

Please paste the files exactly as they are in your configuration, between triple back-ticks, like this:

```
PASTE FILE HERE
```

The error seems to indicate that a problem with the filter block. Without exact pasting between those triple back-ticks, I won't be able to further troubleshoot.

3

Hi,

Ok here we go:
This is: ctaction.yml

---
#Hier werden die Tage eingestellt für den Curator.
actions:
  1:
   action: delete_indices
   options:
    ignore_empty_list: True
    disable_action: False
  filters:
  - filtertype: pattern
    kind: prefix
    value: logstash-
  - filtertype: age
    source: name
    direction: older
    timestring: '%Y.%m.%d'
    unit: days
    unit_count: 3

This is: ctcurator.yml

---
#Curator Konfiguration hiermit werden die Idices von Elasticsearch gelöscht.
client:
 hosts:
 - 127.0.0.1
 port: 9200
 url_prefix:
 use_ssl: False
 certificate:
 client_cert:
 client_key:
 ssl_no_validate: False
 http_auth:
 timeout: 30
 master_only: False

logging:
 loglevel: INFO
 logfile: /var/log/curator.log
 logformat: default
 blacklist: ['elasticsearch', 'urllib3']
4

I see it now. The filters block needs to be indented exactly as far as the options and also action (singular, not actions at the root level.

5

I have corrected that. Now i get the following error:

 /usr/bin/curator --config /etc/curator/ctcurator.yml /etc/curator/ctaction.yml --dry-run
Configuration: Actions File: Location: root: Bad Value: "{1: {'action': 'delete_indices', 'options': {'ignore_empty_list': True, 'disable_action': False}, 'filters': [{'filtertype': 'pattern', 'kind': 'prefix', 'value': 'logstash-'}, {'filtertype': 'age', 'source': 'name', 'direction': 'older', 'timestring': '%Y.%m.%d', 'unit': 'days', 'unit_count': 3}]}}", extra keys not allowed @ data['action']. Check configuration file.

The action files looks now like that.

---
#Hier werden die Tage eingestellt für den Curator.
action:
  1:
   action: delete_indices
   options:
    ignore_empty_list: True
    disable_action: False
   filters:
   - filtertype: pattern
     kind: prefix
     value: logstash-
   - filtertype: age
     source: name
     direction: older
     timestring: '%Y.%m.%d'
     unit: days
     unit_count: 3
6

The root level should still be actions. Just change that top line.

7

Thanks it is working :). Awesome!