# Error when running curator

**URL:** <https://discuss.elastic.co/t/error-when-running-curator/287577>\
**Category:** Elasticsearch\
**Tags:** curator\
**Created:** [October 25, 2021, 12:34pm UTC](https://discuss.elastic.co/t/error-when-running-curator/287577 "2021-10-25T12:34:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jojo123](https://avatars.discourse-cdn.com/v4/letter/j/9fc348/32.png) [@Jojo123](https://discuss.elastic.co/u/Jojo123)\
**Post date:** [October 25, 2021, 12:34pm UTC](https://discuss.elastic.co/t/error-when-running-curator/287577/1 "2021-10-25T12:34:24Z")

</div>

Hello everyone,

I'm an absolute beginner who encounters many problems and haven't find a solution yet.

I've been running Elasticsearch and kibana for some months on a debian 10 VM. Elasticsearch receives logs from 2 winlogbeat agents and I can see everything I want with Kibana (I am not using logstash). That was great, until the space disk of my VM got full (duh !). I obviously couldn't see anything anymore on kibana, and after some testings I was not able to restart properly the kibana service either. I assume that's also because the disk was full.

That is the reason I'm using curator. Or at least I'm trying. I would like to delete everything older than 30 days and despite having many examples on internet I could not make it work.

**.curator/curator.yml**

```auto
---
client:
  hosts:
    - 127.0.0.1
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: False
  username:
  password:
  timeout: 30
  master_only: False

logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

```

**action.yml**

```auto
---
actions:
  1:
    action: delete_indices
    description: Delete indices with %Y.%m.%d in the name where that date is older than 30 days
    options:
      ignore_empty_list: True
    filters:
      - filtertype: age
        source: name
        timestring: '%Y.%m.%d'
        unit: days
        unit_count: 30

```

Here is the error I get when I run curator action.yml

> 2021-10-25 13:41:02,650 ERROR Schema error: required key not provided @ data['direction']  
> 2021-10-25 13:41:02,650 ERROR Schema error: Configuration: filter: Location: Action ID "1", action "delete\_indices", filter #0: {'filtertype': 'age', 'source': 'name', 'timestring': '%Y.%m.%d', 'unit': 'days', 'unit\_count': 30}: Bad Value: "(could not determine)", required key not provided @ data['direction']. Check configuration file.

I know other persons had similar problem but no solution I found online worked.

I suspect one of my problem is the "source" parameter. I guess I'm supposed to replace it with something but I don't know what.  
Does anyone have an idea ? Did I provide enough information ?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [October 25, 2021, 4:05pm UTC](https://discuss.elastic.co/t/error-when-running-curator/287577/2 "2021-10-25T16:05:49Z")

</div>

> [@Jojo123](#):
>
> ```auto
> filters:
> - filtertype: age
> source: name
> timestring: '%Y.%m.%d'
> unit: days
> unit_count: 30
> 
> ```

1. Having _only_ an `age` filter with no `pattern` filter is going to be destructive once your `.kibana` and `.security` (and other) indices are older than 30 days. I cannot overemphasize how bad your experience will be with only this filter in place. In simpler terms, this filter will identify ALL indices (presumably) older than 30 days and perform the indicated action (`delete_indices`) on them, meaning that your `.kibana` and any other index older than 30 days. I'm 100% certain this is not what you want, so I highly recommend using a `pattern` filter _before_ the `age` filter to prevent this from happening to indices you don't want to have deleted.
2. You have omitted the [`direction`](https://www.elastic.co/guide/en/elasticsearch/client/curator/5.8/fe_direction.html) in the `age` filter. Without this, Curator doesn't know whether you're looking for indices `older` or `younger` than the reference point of `30` `days`. This is what the error message is indicating when it says "`required key not provided @data['direction']`"

---

<div class="post-metadata">

**Author:** ![Jojo123](https://avatars.discourse-cdn.com/v4/letter/j/9fc348/32.png) [@Jojo123](https://discuss.elastic.co/u/Jojo123)\
**Post date:** [October 26, 2021, 8:44am UTC](https://discuss.elastic.co/t/error-when-running-curator/287577/3 "2021-10-26T08:44:13Z")

</div>

Thank you very much, the "direction" missing was indeed the problem. I added a pattern too as you recommanded and everything worked well.

Thanks again !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 23, 2021, 8:44am UTC](https://discuss.elastic.co/t/error-when-running-curator/287577/4 "2021-11-23T08:44:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.