Curator --snapshot option matching all snapshots

Elastic Stack Elasticsearch
1

I am trying to use the curator tool to automate deleting older snapshots.

Up until now, I've been using the Elasticsearch API to create the snapshots instead of Curator.

Curator version: 3.5.1

The following:

curator --host `hostname -f` --port 9201 show snapshots --repository logstash_backup

produces a large list of snapshots, just over 200.

Sample:
ls_2016.04.11
ls_2016.04.12
ls_2016.04.13
ls_2016.04.14
ls_2016.04.15
ls_2016.04.16
ls_2016.04.17

Problem 1:
Matching by 'older-than' produces no results - I tried as low as 1 day as you can see in the example:

(13:45:37) PROD ->curator --host `hostname -f`show snapshots --repository logstash_backup --older-than 100 --time-unit days
2016-10-26 13:45:41,737 INFO      Job starting: show snapshots
2016-10-26 13:45:41,885 WARNING   No snapshots matched provided args.
No snapshots matched provided args.

(13:45:41) PROD ->curator --host `hostname -f` show snapshots --repository logstash_backup --older-than 1 --time-unit days
2016-10-26 13:45:46,101 INFO      Job starting: show snapshots
2016-10-26 13:45:46,252 WARNING   No snapshots matched provided args.
No snapshots matched provided args.

Problem 2:
Deleting by specific snapshot name using --snapshot ends up deleting all snapshots instead of just the one specified.
Example below using the 'show' option.

(13:45:46) PROD ->curator --host `hostname -f` --port 9201 show snapshots --repository logstash_backup --snapshot ls_2016.10.19
2016-10-26 13:46:10,868 INFO      Job starting: show snapshots
2016-10-26 13:46:11,120 INFO      Adding ls_2016.10.19 from command-line argument
2016-10-26 13:46:11,120 INFO      Matching snapshots:
ls_2016.04.11
ls_2016.04.12
ls_2016.04.13
ls_2016.04.14
...

This goes on to list all my snapshots. I thought maybe it was seeing the '.' and matching all, so I tried escaping it, but it had no effect.

I did see that this was an issue in earlier Curator versions based on another discussion: Curator is deleting all snapshots
However, the only resolution there was to use older-than and I couldn't find any issues on the github project to match.

Any thoughts?

Thanks in advance

2

Only Curator 4 filters by the actual snapshot creation time. With Curator 3, you need to use a --timestring to match the date in the snapshot name. See https://www.elastic.co/guide/en/elasticsearch/client/curator/3.5/snapshot-selection.html

In your case, it seems that --timestring '%Y.%m.%d' will work.

3

When mentioning "Problem 1", I see that you have not mentioned the port. Curator must be failing with connection process, leading to no snapshots found.
In "Problem 2", you used --snapshot flag which I believe is buggy in the old curator versions as mentioned in the discussion you referenced.

I am using --older-than flag in my setup with curator 3.2.3. Works fine.

4

But --port is not required. If not specified, it defaults to 9200.

Not buggy, per se. It's designed to allow you to re-add a given snapshot that may have been excluded by your filters. In this case, it's merely re-adding it to the list of all snapshots, so it looks like it's not working correctly. To get the desired behavior with example 2, set a --prefix that will not match any snapshots, and then use --snapshot to add the one index you're trying to use.

5

I think David has set the port to 9201.
The very first command he posted which gives a long list of snapshots was using 9201 as the port.
That is why I mentioned the --port thing.

For the second problem, thanks for the info, I was not aware of the --prefix flag.