Delete Indicies older than - Unable to read client configuration

Elastic Stack Beats
1

Have the below config / action file. Always worked until recent updates. Now if I do a dry run i get "Unable to read configuration file. Running as root. Funny thing is, if I create an error like a missing ":" it will state the error.

[root@NOPE curator]# sudo curator ./CONFIG.YML --config ./DELETEIN.YML --dry-run
2018-03-30 11:13:50,167 CRITICAL Unable to read client configuration. Please check the configuration file: ./DELETEIN.YML

Config:

client:
  hosts:
    - 127.0.0.1
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  aws_key:
  aws_secret_key:
  aws_region:
  ssl_no_validate: False
  http_auth:
  timeout: 30
  master_only: False

logging:
  loglevel: DEBUG
  logfile: curatordebug.log
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']


Action File:
# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
#
# Also remember that all examples have 'disable_action' set to True.  If you
# want to use this action as a template, be sure to set this to False after
# copying it.
actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 45 days (based on index name), for logstash-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: winlogbeat-
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 90
      exclude:
2

A few things you can try.

Add triple dashes to the top of the file. This indicates YAML to the interpreter, e.g.

---
client:
  hosts: ...

Another is to remove empty fields, and fields with only default values. As I look at what you have, this results in:

---
logging:
  loglevel: DEBUG
  logfile: curatordebug.log

That's it. The default client host and port are 127.0.0.1 and 9200, so those are unnecessary. Everything else is default values. Curator will put default values in for anything not present.

The only thing that otherwise causes you to have absolutely no output, even with DEBUG logging turned on is hidden escape characters in your config file. What did you use to create this file? What editor? Is there another editor you can use to check? Strange things.

Also, why the all-caps file names? That shouldn't prevent anything, but it is certainly unusual to my eyes.

3

Also, what version of Curator are you currently using? How did you update? Are you using the pre-built RPM or DEB packages, pip, or something else?

4

tried hosts: ... in config no success

Tried removing empty fields: nada

used "vi" and now just used "vim" recreating from scratch, no debug log , even using updatedb / mlocate to try to find the log in case it was created somewhere else

yea just copied / pasted those names in caps, tried with lower case no luck :frowning:

did pip, just tried pip install --upgrade pip , to make sure curator was on latest version. still nada

5

Version information? curator --version output?

$ curator --version
curator, version 5.5.1

Do you have a different result with sudo curator --version?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.