Elasticsearch Curator index pattern

Elastic Stack Elasticsearch
1

Hi,

I'm trying to delete my old indexes with curator, however because of my index format I'm having trouble.

The format of my indices is sg-YYYY-WW but the weeks start at sg-2017-1 not sg-2017-01. This is causing my trouble with the curator age filter. Below is my config but it misses any indices with a single digit week number. Any advice on this?

actions:
  1:
action: delete_indices
description: >-
  Delete indices older than 45 days (based on index name), for logstash-
  prefixed indices. Ignore the error if the filter does not result in an
  actionable list of indices (ignore_empty_list) and exit cleanly.
options:
  ignore_empty_list: True
  timeout_override:
  continue_if_exception: False
filters:
- filtertype: pattern
  kind: prefix
  value: sg-
  exclude:
- filtertype: age
  source: name
  direction: older
  timestring: '%Y-%-W'
  unit: weeks
  unit_count: 4
  exclude:

Thanks,

Ross

2

Non-zero padded weeks just won't work the way you want, if you're trying to act by name. Only %W and %U handle weeks and both are zero-padded.

In very short order, Curator 5 will be released (but will only work with Elasticsearch 5.x), and it has a new period filter, which allows for easier index selection by week, and you'd be able to match by creation_date instead of name. You can still match by creation_date now, but only with the age filter, where a week is 60*60*24*7 seconds, and is completely relative to execution time. That's the best I can offer you now. In either case, you'd have to match the timestring by a regex pattern anyway, and not by name, due to the zero-padding issue.

3

Okay,

Thanks for the quick reply.

4

Using the creation_date solved my problem!

Thank you

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.