Deleting indices 30 days older

Elastic Stack Elasticsearch
1

Hi am using Curator V 4.3.1 to delete the indices in my ES V 2.2.0
My action.yml looks like this

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 28 days (based on index name), for logstash-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      timeout_override: 9999999
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: idmcrt-
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 30
      exclude:

The problem is this is not working as expected,
instead of deleting the indices which are older than 30 days it's including the recent indices as well.

2

Without more information it will be hard to know what it is you're describing. Can you share the log lines that Curator made? Particularly the ones showing it deleting indices not matching the patterns you've provided.

3

It is matching the particular pattern idmcrt- no problem with that.
Flushing out all the indices is the problem. So below is the action.log file once i ran the curator with action file.
It is deleting all the indices, not only the indices which are older than 30 days.

2017-06-16 04:54:57,281 INFO      ---deleting index idmcrt-2016.05.31
2017-06-16 04:54:57,281 INFO      ---deleting index idmcrt-2016.05.30
2017-06-16 04:54:57,281 INFO      ---deleting index idmcrt-2016.06.01
2017-06-16 04:54:57,281 INFO      ---deleting index idmcrt-2016.05.28
2017-06-16 04:54:57,281 INFO      ---deleting index idmcrt-2016.05.29
2017-06-16 04:54:57,281 INFO      ---deleting index idmcrt-2016.05.27
2017-06-16 04:55:07,142 INFO      Action ID: 1, "delete_indices" completed.
2017-06-16 04:55:07,142 INFO      Job completed.
4

As you can see from the logs you pasted, Curator lists every index it deletes. If it isn't listed, it is highly unlikely that Curator deleted it. If you're experiencing other indices being deleted, and still think it's Curator, you'll need to run Curator with loglevel: DEBUG, and blacklist: []. The blacklist part is critical, because with this setting, you'll be able to see every call made to Elasticsearch. If something unexpected were happening, it would be visible there.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.