Curator for logstash

Elastic Stack Logstash
1

Hello there

I have query on some of the curator actions, ex: 'Close' action. Would like to know what is the use of it . Not sure if this is the right place to ask about curator, i couldn't find any curator specific forum.

I was looking at https://www.elastic.co/guide/en/elasticsearch/client/curator/current/ex_close.html which does not have any detail on what the use of 'Close' action is. Can someone please brief me about it. On a website I found that the 'Close' action saves memory and CPU. I would like to know how does it do so.

Thanks!

2

The Curator documentation does cover the close action.

In a nutshell, closing an index removes it from the cluster state, and makes it unavailable for searching and analytics, but preserves the data files on the disk. A closed index can then be opened at a later date, after which it is added back to the cluster state, and will be available for searching and analytics. This is why a closed index saves memory and CPU—it is only occupying disk space.

1 Like
3

Thank you Aaron!

I don't see the detailed definition https://www.elastic.co/guide/en/elasticsearch/client/curator/5.5/close.html in the link. Am I looking at the correct link? Or can you point me to the page where it defines all the actions in detail please.

Regards!

4

Sure! They are in the examples. The close example is here. Do read the commented section carefully as it provides some instruction regarding the disable_action setting.

5

Hi Aaron,

Thank you for the response.

I did take a look at the examples and I feel it would have been better to add some more detail on what each action does. For ex, the description for allocation action says - apply shard allocation routing to 'require' 'tag=cold' for hot/cold node setup for logstash- indices older than 3 days, based on index_creation date, while i did not find anything on what hot/cold node setup is.

And yes, i have taken a look at disable_action setting and have also executed delete action.

Regards

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.