I am using Curator 4.0.0 to manage a bunch of indices, and when I try to specify several filters in a single actions.yml, it seems to do something odd.
I have four things going into ES: WinLogBeat, FileBeat, MetricBeat and PacketBeat. I want different timeouts for some of these, so I have the following actions.yml:
actions:
1:
action: delete_indices
options:
continue_if_exception: True
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: winlogbeat-
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: months
unit_count: 1
2:
action: delete_indices
options:
continue_if_exception: True
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: filebeat-
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: months
unit_count: 1
3:
action: delete_indices
options:
continue_if_exception: True
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: metricbeat-
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: months
unit_count: 1
4:
action: delete_indices
options:
continue_if_exception: True
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: packetbeat-
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 6
And if I run curator with that config, I get the "nothing to delete" error.
If I run it just with the last section, I correctly get a bunch of deleted indices:
1:
action: delete_indices
options:
continue_if_exception: True
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: packetbeat-
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 6
Output:
2017-01-03 13:14:57,796 INFO DRY-RUN: delete_indices: packetbeat-2016.12.14 with arguments: {}
2017-01-03 13:14:57,796 INFO DRY-RUN: delete_indices: packetbeat-2016.12.15 with arguments: {}
2017-01-03 13:14:57,796 INFO DRY-RUN: delete_indices: packetbeat-2016.12.16 with arguments: {}
2017-01-03 13:14:57,796 INFO DRY-RUN: delete_indices: packetbeat-2016.12.17 with arguments: {}
2017-01-03 13:14:57,796 INFO DRY-RUN: delete_indices: packetbeat-2016.12.18 with arguments: {}
2017-01-03 13:14:57,796 INFO DRY-RUN: delete_indices: packetbeat-2016.12.19 with arguments: {}
2017-01-03 13:14:57,796 INFO DRY-RUN: delete_indices: packetbeat-2016.12.20 with arguments: {}
2017-01-03 13:14:57,796 INFO DRY-RUN: delete_indices: packetbeat-2016.12.21 with arguments: {}
2017-01-03 13:14:57,797 INFO DRY-RUN: delete_indices: packetbeat-2016.12.22 with arguments: {}
2017-01-03 13:14:57,797 INFO DRY-RUN: delete_indices: packetbeat-2016.12.23 with arguments: {}
2017-01-03 13:14:57,797 INFO DRY-RUN: delete_indices: packetbeat-2016.12.24 with arguments: {}
2017-01-03 13:14:57,797 INFO DRY-RUN: delete_indices: packetbeat-2016.12.25 with arguments: {}
2017-01-03 13:14:57,797 INFO DRY-RUN: delete_indices: packetbeat-2016.12.26 with arguments: {}
2017-01-03 13:14:57,797 INFO DRY-RUN: delete_indices: packetbeat-2016.12.27 with arguments: {}