Curator Delete indicies based on disk size and index age

[Jayabal_K]

I saw some examples to delete indicies based on size and disk_space, can I use both the filters in one action. I want to delete the indicies which is n days older or it occupies nGB If any one of the condition meets then that index need to be deleted. Consider indicies are time based ones (test-2019.07.05.11.05-1).

Could you help me by suggesting some examples for this?

[theuntergeek (Aaron Mildenstein)]

Curator filters are AND based. The only real way to accomplish a logical OR like this is with two separate action blocks:

---
actions:
  1:
    action: delete_indices
    description: Delete if indices are over YOUR_VALUE_HERE days
    options:
      ignore_empty_list: true
    filters:
      - filtertype: pattern
        kind: prefix
        value: myprefix-
      - filtertype: age
        source: name
        timestring: '%Y.%m.%d.%H'
        direction: older
        unit: days
        unit_count: YOUR_VALUE_HERE
  2:
    action: delete_indices
    description: Delete if indices consume more than YOUR_VALUE_HERE gigabytes
    options:
      ignore_empty_list: true
    filters:
      - filtertype: pattern
        kind: prefix
        value: myprefix-
      - filtertype: space
        disk_space: YOUR_VALUE_HERE
        use_age: true
        source: name
        timestring: '%Y.%m.%d.%H'

What happens with this action file is that it first checks to see if anything is older than YOUR_VALUE_HERE days. If none are found, it will ignore_empty_list and move on without an error. It will then run action 2, and it filters for only indices matching the defined prefix (the example has myprefix-), and will sum the disk space consumed by each of those indices, and will delete any indices in excess of YOUR_VALUE_HERE, beginning with the oldest. This example, too, will exit without error even if no indices match (ignore_empty_list).

You can read more about the space filter type here.