Curator_cli jason query question

[alexsamad]

Hi

I have indexes like
-filebeats-YYYY.MM.DD

uat-filebeat-2018.05.25
dev-filebeat-2018.05.25
prod-filebeat-2018.05.25

I would like to keep say prod for 45 days and non prod for say 7 days.

I found on here

Delete Indices older than 30 days

I tried that, but got the same result, then changed to IP and got the following: `curator_cli --host 10.240.1.130 show_indices --filter_list '{"filtertype":"age","source":"name","timestring":"%Y.%m.%d","unit":"days","unit_count":30}' 2017-08-11 14:50:32,593 ERROR Schema error: required key not provided @ data['direction'] 2017-08-11 14:50:32,593 ERROR Schema error: Configuration: filter: Location: singleton, filter #0: {'filtertype': 'age', 'source': 'name', 'timestring': '%Y.%m.%…

but I am having issues changing the filter to filter on source name as well

using this
curator_cli show_indices --filter_list '{"filtertype":"age","source":"name","timestring":"%Y.%m.%d","unit":"days","unit_count":30,"direction":"older"}'

which translates to this yaml

actions:
1:
action: delete_indices
description: Delete indices with %Y.%m.%d in the name where that date is older than 30 days
options:
ignore_empty_list: True
filters:
- filtertype: age
source: name
timestring: '%Y.%m.%d'
unit: days
unit_count: 30
direction: older

I know I can change the 30 to 45 or 14 as needed but how do I also filter on say

prod-*
and
not prod-*

thanks

[pjanzen (Paul Janzen)]

Within the yml file you can create multiple actions. So if you have 3 indices and each of them has a different retention you could do something like this.

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 7 days (based on index name), for uat-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: uat-filebeat-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7
  2:
    action: delete_indices
    description: >-
      Delete indices older than 7 days (based on index name), for dev-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: dev-filebeat-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7
  3:
    action: delete_indices
    description: >-
      Delete indices older than 45 days (based on index name), for prod-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: prod-filebeat-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 45