Curator_cli jason query question

Elastic Stack Elasticsearch
1

Hi

I have indexes like
-filebeats-YYYY.MM.DD

uat-filebeat-2018.05.25
dev-filebeat-2018.05.25
prod-filebeat-2018.05.25

I would like to keep say prod for 45 days and non prod for say 7 days.

I found on here

but I am having issues changing the filter to filter on source name as well

using this
curator_cli show_indices --filter_list '{"filtertype":"age","source":"name","timestring":"%Y.%m.%d","unit":"days","unit_count":30,"direction":"older"}'

which translates to this yaml

actions:
1:
action: delete_indices
description: Delete indices with %Y.%m.%d in the name where that date is older than 30 days
options:
ignore_empty_list: True
filters:
- filtertype: age
source: name
timestring: '%Y.%m.%d'
unit: days
unit_count: 30
direction: older

I know I can change the 30 to 45 or 14 as needed but how do I also filter on say

prod-*
and
not prod-*

thanks

2

Within the yml file you can create multiple actions. So if you have 3 indices and each of them has a different retention you could do something like this.

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 7 days (based on index name), for uat-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: uat-filebeat-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7
  2:
    action: delete_indices
    description: >-
      Delete indices older than 7 days (based on index name), for dev-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: dev-filebeat-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7
  3:
    action: delete_indices
    description: >-
      Delete indices older than 45 days (based on index name), for prod-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: prod-filebeat-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 45
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.