Curator and how to delete certain indices

Elastic Stack Elasticsearch
1

Hi. Right now I purge indices older than 7days. I have other indices that I need to delete sooner and others I need to keep forever. Is there an easy way to do this? an extract of my actions.yml file is below.

Thanks.

actions:
1:
action: delete_indices
description: >-
adjust indices older than x days (based on pattern), for timestring-
prefixed indices.
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: timestring
value: '%Y.%m.%d'
exclude:
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 7
exclude:

2

Your paste is not properly formatted, so I can't tell what you have in your actual file. When pasting code, use the </> code tag in the editor, or encapsulate your text in triple back ticks like this:

```
PASTE HERE
```

With that said, it depends on what you mean by "easy."

You only need to build onto your filters until only the indices you want are included, and all other excluded. You can add multiple actions in sequence until each desired behavior is achieved.

3

Ahh yes thanks.
I created another action-twitter.yml file and I call it with a more specific file:

root@els01:/etc/curator# cat /etc/curator/action-twitter.yml 
# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
#
# Also remember that all examples have 'disable_action' set to True.  If you
# want to use this action as a template, be sure to set this to False after
# copying it.
actions:
  1:
    action: delete_indices
    description: >-
      adjust indices older than x  days (based on pattern), for timestring-
      prefixed indices.
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: timestring
      value: 'twitter' 
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 5
      exclude:
root@els01:/etc/curator#

I'm good now thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.