Hi All,
I am using curator 4.0.5 to delete indices older than 45 days. I was trying their default example. However I am getting some weird exception:
anks@maverick:~$ curator --config curator-config.yml delete_action.yml 2016-08-11 17:20:36,576 INFO Action #1: delete_indices 2016-08-11 17:20:36,901 ERROR Failed to complete action: delete_indices. <type 'exceptions.ValueError'>: day is out of range for month
Here is my config file and action files.
Config:
---
# Remember, leave a key empty if there is no value. None will be a string,
# not a Python "NoneType"
client:
hosts:
- localhost
port: 9200
url_prefix:
use_ssl: False
certificate:
client_cert:
client_key:
aws_key:
aws_secret_key:
aws_region:
ssl_no_validate: False
http_auth:
timeout: 30
master_only: False
logging:
loglevel: DEBUG
logfile:
logformat: default
blacklist: ['elasticsearch', 'urllib3']
Action:
---
actions:
1:
action: delete_indices
description: >-
Delete indices older than 45 days (based on index name), for logstash-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: logstash-
exclude:
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 5
exclude:
Can any one please help me with this. Thanks
Can you edit and reformat configuration files you pasted? They should be preceded and followed by ``` on a line by itself. This will allow me to see if there is anything wrong with indentation, which matters to the syntax.
Hi Aaron, Thanks for the reply. I have changed my config and action to png images as for some reason this pre-formatted text is not working. Sorry I am very new to this group.
As such I am sure that the syntax of yaml should be good as I am just using the samples.
Also after some googling it seems like the error is related to date parsing by python. I cross checked that all my logstash index names are actually having dates in the format specified in action file i.e. timestring: '%Y.%m.%d'
So now I am completely clueless what is really happening.
I can't cut/paste PNGs. I still need you to put it in as text, but with ``` above.
e.g.
# blank line here
actions:
1:
action: delete_indices
description: >-
Delete indices older than 15 days (based on index name), for any Year.month.day
indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 15
exclude:
# blank line here
Make sure there is a blank line above the top ``` and beneath the bottom one. Also remove any spaces after ```, as I used those to allow them to work here and not be interpreted.
Also, please include the DEBUG output, as I'm guessing that you have an index which does not fit the pattern. For example, the date pattern '%Y.%m.%d' gets translated into a regular expression matching 4 digits, a period, 2 digits, a period, and 2 digits—and then it is parsed to see if it's a date. The error day is out of range for month suggests that one or more of your indices that matches that numeric pattern has a month that is greater than 12, or something like that.
You are absolutely right, my index name was causing this issue. One of my index was not matching the pattern. Thanks for your time and guidance Aaron.