# Curator\_cli jason query question

**URL:** https://discuss.elastic.co/t/curator-cli-jason-query-question/161056
**Category:** Elasticsearch
**Created:** [December 17, 2018, 12:00am UTC](https://discuss.elastic.co/t/curator-cli-jason-query-question/161056 "2018-12-17T00:00:35Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![alexsamad](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@alexsamad](https://discuss.elastic.co/u/alexsamad)
#### Post date: [December 17, 2018, 12:00am UTC](https://discuss.elastic.co/t/curator-cli-jason-query-question/161056/1 "2018-12-17T00:00:35Z")

</div>

Hi

I have indexes like  
-filebeats-YYYY.MM.DD

uat-filebeat-2018.05.25  
dev-filebeat-2018.05.25  
prod-filebeat-2018.05.25

I would like to keep say prod for 45 days and non prod for say 7 days.

I found on here

> [@Delete Indices older than 30 days](https://discuss.elastic.co/t/delete-indices-older-than-30-days/96630/8):
>
> I tried that, but got the same result, then changed to IP and got the following: `curator\_cli --host 10.240.1.130 show\_indices --filter\_list '{"filtertype":"age","source":"name","timestring":"%Y.%m.%d","unit":"days","unit\_count":30}' 2017-08-11 14:50:32,593 ERROR Schema error: required key not provided @ data['direction'] 2017-08-11 14:50:32,593 ERROR Schema error: Configuration: filter: Location: singleton, filter #0: {'filtertype': 'age', 'source': 'name', 'timestring': '%Y.%m.%…

but I am having issues changing the filter to filter on source name as well

using this  
curator\_cli show\_indices --filter\_list '{"filtertype":"age","source":"name","timestring":"%Y.%m.%d","unit":"days","unit\_count":30,"direction":"older"}'

## which translates to this yaml

actions:  
1:  
action: delete\_indices  
description: Delete indices with %Y.%m.%d in the name where that date is older than 30 days  
options:  
ignore\_empty\_list: True  
filters:  
- filtertype: age  
source: name  
timestring: '%Y.%m.%d'  
unit: days  
unit\_count: 30  
direction: older

I know I can change the 30 to 45 or 14 as needed but how do I also filter on say

prod-\*  
and  
not prod-\*

thanks

---

<div class="post-metadata">

### Author: ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [December 17, 2018, 12:41am UTC](https://discuss.elastic.co/t/curator-cli-jason-query-question/161056/2 "2018-12-17T00:41:46Z")

</div>

Within the yml file you can create multiple actions. So if you have 3 indices and each of them has a different retention you could do something like this.

```
actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 7 days (based on index name), for uat-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: uat-filebeat-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7
  2:
    action: delete_indices
    description: >-
      Delete indices older than 7 days (based on index name), for dev-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: dev-filebeat-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7
  3:
    action: delete_indices
    description: >-
      Delete indices older than 45 days (based on index name), for prod-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: prod-filebeat-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 45
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 14, 2019, 12:41am UTC](https://discuss.elastic.co/t/curator-cli-jason-query-question/161056/3 "2019-01-14T00:41:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.