Hope this is the right place to post this:
I've installed Curator 4.0.1, and am using it to delete indices older than 14 days. It works fine if I'm only trying to delete a single index like logstash or filebeat. However,I'm trying to customize the example delete_indices.yml to delete my filebeat, packetbeat, and topbeat indices in one pass. But, I can't fine the right directive to accomplish that. Here's what the file looks like:
actions:
1:
action: delete_indices
description: >-
Delete indices older than 14 days (based on index name), for beat-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: False
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind:
value:
exclude:
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 14
exclude: False
It's the filters "kind" and "value" that I can't seem to get right. Help would, as always, be appreciated.