Elasticsearch curator not deleting indices

Elastic Stack Elasticsearch
1

Here's our actionfile :slight_smile:

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 3 days (based on index name), for logstash-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: eside-
    - filtertype: age
      source: name
      direction: older
      timestring: '%YYYY.%mm.%dd'
      unit: days
      unit_count: 3

The after running the curator, here's the debug msgs :slight_smile:

2017-12-05 06:49:03,357 DEBUG          curator.indexlist          filter_by_age:431  Filtering indices by age
2017-12-05 06:49:03,357 DEBUG          curator.indexlist   _get_name_based_ages:229  Getting ages of indices by "name"
2017-12-05 06:49:03,357 DEBUG          curator.indexlist       empty_list_check:184  Checking for empty list
2017-12-05 06:49:03,357 DEBUG              curator.utils         get_date_regex:195  regex = \d{4}YYY\.\d{2}m\.\d{2}d
2017-12-05 06:49:03,358 DEBUG          curator.indexlist           working_list:195  Generating working list of indices
2017-12-05 06:49:03,358 DEBUG          curator.indexlist           working_list:195  Generating working list of indices
2017-12-05 06:49:03,358 DEBUG          curator.indexlist          filter_by_age:492  Index "eside-2017.08.21" does not meet provided criteria. Removing from list.
2017-12-05 06:49:03,358 DEBUG          curator.indexlist          filter_by_age:492  Index "test-20171127-logstash-1" does not meet provided criteria. Removing from list.

Help please :frowning:

2

First, please properly encapsulate your config file within triple back ticks, like this:

```
PASTED CONTENT HERE
```

It's nearly impossible to tell if YAML is properly formatted if this isn't done.

That said, however, it appears that you have unnecessary extra characters and in your timestring. It should be timestring: '%Y.%m.%d'. Extra characters are needed in Logstash, perhaps, but not Curator.

3

Thank you so much, that was quick! Also for the formatting <3

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.