Elasticsearch Curator Snapshot: How does it work?

Elastic Stack Elasticsearch
1

I have attached the example for Curator Snapshot.yml
Will only the indices with names logstash- be snapshotted?
How do I snapshot indices with different names?

---
# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
#
# Also remember that all examples have 'disable_action' set to True.  If you
# want to use this action as a template, be sure to set this to False after
# copying it.
actions:
  1:
    action: snapshot
    description: >-
      Snapshot logstash- prefixed indices older than 1 day (based on index
      creation_date) with the default snapshot name pattern of
      'curator-%Y%m%d%H%M%S'.  Wait for the snapshot to complete.  Do not skip
      the repository filesystem access check.  Use the other options to create
      the snapshot.
    options:
      repository:
      # Leaving name blank will result in the default 'curator-%Y%m%d%H%M%S'
      name:
      ignore_unavailable: False
      include_global_state: True
      partial: False
      wait_for_completion: True
      skip_repo_fs_check: False
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: logstash-
      exclude:
    - filtertype: age
      source: creation_date
      direction: older
      unit: days
      unit_count: 
      exclude:
2

I took the liberty of editing your post to encapsulate it in triple back-ticks:

```
your post here
```

This is what you should do when pasting configuration files.

Based on the filters you have, it won't even work. You do have a prefix filter which will select only indices starting with logstash-, but you also have an age filter but have not defined a unit_count, which will result in an error. If you wanted to snapshot logstash- prefixed indices older than 30 days, you could put 30 after unit_count:, and then that's what would be snapshotted.

There are many different approaches you can take to snapshot more than just logstash- indices. What other patterns would you like to snapshot?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.