Curator - delete everything except a time perioed

[yungnvn (Naveen)]

Hi,

I am trying to delete a certain index past 24 days but keep a certain timeperiod from it. For example,

I want do delete everything older than 24 days but keep stuff from October '18 - December '18.

Here is the config i'm currently using:

actions:
1:
action: delete_indices
description: >-
Delete indices older than 24 days (based on index name), for purgatory-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: purgatory-
exclude:
- filtertype: pattern
kind: prefix
value: purgatory-2018.10-
exclude: True
- filtertype: pattern
kind: prefix
value: purgatory-2018.11-
exclude: True
- filtertype: pattern
kind: prefix
value: purgatory-2018.12-
exclude: True
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 24
exclude:

As you can see, i'm trying to delete anything older than 24 days but keep anything starting with purgatory-2018.10, purgatory-2018.11, purgatory-2018.12. I tried this in QA but hasn't worked.

If anyone has suggestions, any help would be appreciated!

Thanks

[theuntergeek (Aaron Mildenstein)]

@yungnvn

- filtertype: age
  source: name
  direction: older
  timestring: '%Y.%m.%d'

@yungnvn

- filtertype: pattern
  kind: prefix
  value: purgatory-2018.12-
  exclude: True

Your value for the prefix filter has a - at the end, but the timestring you're looking for is delimited by periods .. I'm guessing that if you changed your values to purgatory-2018.12. and similarly for the others, it will actually work the way you want.

[yungnvn (Naveen)]

Ah ! That makes sense. It's working now. Thanks a lot for the help!