Hello! I hope someone can help me
I need to take snapshot only for 1 day per day
and I need to delete logs for 1 day per day
In other words
I want to take snapshots of today a month ago
And delete logs of today a month ago
My CURL DELETE command to delete all logs, looks like this
curl -XDELETE '127.0.0.1:9200/filebeat-*?pretty'
but i need to delete only the logs of a month ago
My snapshot.yml is
actions: 1: action: snapshot description: >- Snapshot log-production- prefixed indices older than 1 day (based on index creation_date) with the default snapshot name pattern of 'curator-%Y%m%d%H%M%S'. Wait for the snapshot to complete. Do not skip the repository filesystem access check. Use the other options to create the snapshot. options: repository: logs_backup # Leaving name blank will result in the default 'curator-%Y%m%d%H%M%S' name: esdemo-%Y%m%d%H%M%S ignore_unavailable: False include_global_state: True partial: False wait_for_completion: True skip_repo_fs_check: False disable_action: False filters: - filtertype: pattern kind: prefix value: filebeat- - filtertype: age source: creation_date direction: older unit: days unit_count: 1
How can I take snapshots a month ago?
Today is March 22
I need to take snapshot of 22 Feb
And then delete the 22 Feb logs