Curator for deleting indices older than 30 days or more based on a field that isn't of type date

Elastic Stack Elasticsearch
1

{
"_index": "user:1494813192000",
"_type": "fruits",
"_id": "pbyac5r88-yghe-v1ez-cpgb-sqdjipr54alzgj/tp4oqalbd-bo2v-ikj1-atfq-wezcoeeuf6wiqpt/apple",
"_score": 1,
"_routing": "pbyac5r88-yghe-v1ez-cpgb-sqdjipr54alzgj",
"_source": {
"numCal": 442,
"eventTime": 1497315192000,
"fruitName": "apple"
}

This is how the index in my elasticsearch looks like. The eventTime is the current time in ms based on UTC. I would want to use that field to delete my indices using the curator.

This is how my ACTION_FILE.YML looks like
actions:
1:
action: delete_indices
description: >-
Delete indices older than 45 days (based on index name), for logstash-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: age
source: field_stats
field: 'eventTime'
direction: older
unit: days
unit_count: 30
exclude:

Does curator support deleting based on fields that aren't in data format?

2

In Linux/Unix systems, you use cron. In Windows, use the Task Scheduler.

3

Thanks. I realized that I was missing the index prefix too, it worked after I put that inside the yml file. Also how do I make this a recurring job that the curator would do.

4

There isn't a parameter that could be set in the ACTION file to make it recur ?

5

No. It's not presently designed to be daemonized.

6

Thanks for the quick reply. Btw how would you suggest doing this, having a cron job or having a docker with curator running on the elasticsearch machine.

7

Either is completely acceptable. cron may be slightly more common, but I see a lot of both cron and Docker

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.