Curator doesn't delete indices


(Emil Eldar Rustamov) #1

Dear all,

Curator doesn't delete indices 5 according to settings.

Here are my settings:

curator.yml

client:
  hosts: "99.99.99.99"
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  aws_key:
  aws_secret_key:
  aws_region:
  ssl_no_validate: False
  http_auth:
  timeout: 30
  master_only: False

logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

actions.yml

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 6 days (based on index name), for logstash-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: logs-
      exclude:
    - filtertype: pattern
      kind: prefix
      value: kubernetes-
      exclude:
    - filtertype: age
      source: creation_date
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 5
      exclude:

What is the reason?


Curator delete_indices fail
(Aaron Mildenstein) #2

Please edit and correct the original post to have the pasted config files between triple back-ticks like this:

```
PASTED CONFIG HERE
```

It's too hard to read them properly otherwise, especially since proper indentation is necessary for YAML configuration files.


(Emil Eldar Rustamov) #3

Done


(Aaron Mildenstein) #4

So, immediately I see that you have two pattern type filters, trying to match prefix logs- and prefix kubernetes-. This is your problem. In the official documentation it explains that all filters are connected by logical a AND. It does provide an example of using kind: regex to do a logical OR for pattern matching. This would allow you to catch both logs- and kubernetes- prefix types.


(Emil Eldar Rustamov) #5

You mean that i can use it this way?

filters:
- filtertype: pattern
kind: prefix
value: logs- AND kubernetes-


(Aaron Mildenstein) #6

No. Did you read the link to the documentation I provided? It has this example in it:

  filters:
  - filtertype: pattern
    kind: regex
    value: '^(alpha-|bravo-|charlie-).*$'

For your case, it would be

    value: '^(logs-|kubernetes-).*$'

(Emil Eldar Rustamov) #7

Thanks a lot, Aaron! It is working. :slight_smile:


(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.