Delete Indices with Curator correct timestring format

Elastic Stack Elasticsearch
1

Hello!
I'm trying to delete with Curator Indices that are older than X time.
Seems like after running curator, it doesn't really work, because I still can see older Indices when running curl -X GET "localhost:9200/_cat/indices?v" command.

My Index format from Logstash conf file -

index => "apps-prod-dal10-%{[kubernetes][namespace]}-deployment-%{[kubernetes][pod][name]}-%{[kubernetes][labels][app]}-%{[kubernetes][container][name]}-%{+YYYY.MM.dd}"

And my curator action file is

---
actions:
 1:
   action: delete_indices
   description: >-
     Delete  indices older then 14 days.
   options:
     ignore_empty_list: True
     disable_action: True
   filters:
   - filtertype: pattern
     kind: prefix
     value: apps-
   - filtertype: age
     source: name
     direction: older
     timestring: '%YYYY.%MM.%dd'
     unit: days
     unit_count: 14

Maybe it's related to timestring format? What it should be like with this kind of Index?

Thanks,

Aleksei

2

That timestring is using Logstash format. The [Curator timestring] uses a python format. For Year.Month.Day in Curator, it is %Y.%m.%d

3

Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.