Issue: Current configuration of “ unit_count” in action.yml file is 180 days but when this file is invoked the logs are not getting deleted as per configured values. As per current configuration(unit_count=180 days) , all the logs files before 180 should get deleted but in actual the logs files before 180 days are also getting deleted. Below is how action.yml file looks like
actions:
1:
action: delete_indices
description: >-
Delete indices older than 180 days (based on index name), for logstash-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: logstash-
exclude:
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 180
exclude:
But data is being deleted that is younger than that.
Can somone suggest is that the right configuration