Deleting index using curator older than 25 days

Elastic Stack Elasticsearch
1

Hi,

I am trying to deleting index which is older than 25 days.

Below are error i am getting
[root@eltest1 elasticsearch-curator]# curator delete_3mOdl.yml
2019-08-02 14:02:50,739 INFO Preparing Action ID: 1, "delete_indices"
2019-08-02 14:02:50,777 INFO Trying Action ID: 1, "delete_indices": Delete application-%Y.%m.%d indices older than 1 day
2019-08-02 14:02:51,036 INFO Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>
2019-08-02 14:02:51,037 INFO Action ID: 1, "delete_indices" completed.
2019-08-02 14:02:51,037 INFO Job completed.

But there is index available in elasticsearch

Below are the action.yml file

 1:
    action: delete_indices
    description: >-
      Delete application-%Y.%m.%d indices older than 1 day
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: regex
      value: '^metricbeat-6.7.1-\d{4}\.\d{2}.\d{2}'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 25
2

If you set loglevel to DEBUG, the log output will show you how Curator measured and decided the ages of your indices. That's the best first place to look.

3 
2019-08-05 16:01:32,162 DEBUG          curator.indexlist            __excludify:58   Remains in actionable list: Index "metricbeat-6.7.1-2019.07.07" age (1562437846), direction: "older", point of reference, (1562495492)
2019-08-05 16:01:32,163 DEBUG          curator.indexlist           __actionable:35   Index metricbeat-6.7.1-2019.07.04 is actionable and remains in the list.
2019-08-05 16:01:32,163 DEBUG          curator.indexlist            __excludify:58   Remains in actionable list: Index "metricbeat-6.7.1-2019.07.04" age (1562178646), direction: "older", point of reference, (1562495492)

This is my debug information will please tell me how its calculating

4 
actions:
  1:
    description: "Reindex application into"
    action: reindex
    options:
      disable_action: False
      wait_interval: 9
      max_wait: -1
      request_body:
        source:
          index: REINDEX_SELECTION
        dest:
          index: <metricbeat-{now/M-1M{YYYY.MM}}>
    filters:
    - filtertype: pattern
      kind: regex
      value: metricbeat-*
    - filtertype: age
      source: creation_date
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 29`Preformatted text`

This is my yml configuration

5

Using the online epoch time converter:

1562437846 => Saturday, July 6, 2019 6:30:46 PM UTC

is older than the "point of reference":

1562495492 => Sunday, July 7, 2019 10:31:32 AM UTC

This is a simple greater-than/less-than comparison of the large integer value. Since epoch time is continuously growing, if a value is bigger, it's more recent.

So the date value in metricbeat-6.7.1-2019.07.07 is not being used at all because you have source: creation_date, which uses index metadata stored in Elasticsearch. It reflects the actual time in millisecond resolution of when Elasticsearch created the index. This value is stored inside Elasticsearch as an epoch time value, or 1562437846 in this instance.

The point of reference, (1562495492) is calculated by Curator. It uses unit and unit_count to calculate the epoch time for the point of reference. In the configuration you provided, that would be 29 days previous to the time of execution.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.