Hello,
I'm new to ELK running a the latest version and latest version of curator which I'm setting up for log retention. I have 1 Kibana box, 1 Logstash, 3 master nodes and 5 ES or data nodes. I have curator installed on 1 master node with 2 .yml files: curator.yml (config) and delete_indices_size_base.yml (action). Both located in /usr/curator/ directory.
My curator.yml contains:
<
Remember, leave a key empty if there is no value. None will be a string,
not a Python "NoneType"
client:
hosts: [ "10.x.x.x", "10.x.x.x", "..." ] (abbrev. line for the post)
port: 9200
url_prefix:
use_ssl: False
certificate:
client_cert:
client_key:
ssl_no_validate: False
http_auth:
timeout: 30
master_only: False
logging:
loglevel: DEBUG
logfile:
logformat: default
blacklist: ['elasticsearch', 'urllib3']
/>
action file contains:
<
actions:
1:
action: delete_indices
description: >-
Delete indices matching the prefix filebeat in excess of
300GB of data (75% of 400GB) , starting with the oldest indices, based on index creation_date.
An empty index list (from no indices being in excess of the size limit, for
example) will not generate an error.
options:
ignore_empty_list: True
timeout_override: 300
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: filebeat-
- filtertype: space
disk_space: 300
use_age: True
source: creation_date
2:
action: delete_indices
description: >-
Delete indices matching the prefix tomcat in excess of
300GB of data (75% of 400GB) , starting with the oldest indices, based on index creation_date.
An empty index list (from no indices being in excess of the size limit, for
example) will not generate an error.
options:
ignore_empty_list: True
timeout_override: 300
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: syslog-
- filtertype: space
disk_space: 300
use_age: True
source: creation_date
3:
action: delete_indices
description: >-
Delete indices matching the prefix tomcat in excess of
300GB of data (75% of 400GB) , starting with the oldest indices, based on index creation_date.
An empty index list (from no indices being in excess of the size limit, for
example) will not generate an error.
options:
ignore_empty_list: True
timeout_override: 300
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: winlogbeat-
- filtertype: space
disk_space: 300
use_age: True
source: creation_date
/>
and the error I'm receiving when I ran curator --config curator.yml --dry-run delete_indices_size_base.yml is:
<
File "/usr/lib/python2.7/site-packages/curator/utils.py", line 53, in get_yaml
cfg = yaml.load(raw)
File "/usr/lib64/python2.7/site-packages/yaml/init.py", line 71, in load
return loader.get_single_data()
File "/usr/lib64/python2.7/site-packages/yaml/constructor.py", line 37, in get_single_data
node = self.get_single_node()
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 36, in get_single_node
document = self.compose_document()
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 55, in compose_document
node = self.compose_node(None, None)
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 133, in compose_mapping_node
item_value = self.compose_node(node, item_key)
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 127, in compose_mapping_node
while not self.check_event(MappingEndEvent):
File "/usr/lib64/python2.7/site-packages/yaml/parser.py", line 98, in check_event
self.current_event = self.state()
File "/usr/lib64/python2.7/site-packages/yaml/parser.py", line 439, in parse_block_mapping_key
"expected <block end>, but found %r" % token.id, token.start_mark)
yaml.parser.ParserError: while parsing a block mapping
in "<string>", line 3, column 3:
1:
^
expected <block end>, but found '<block mapping start>'
in "<string>", line 41, column 4:
3:
/>
Any help is greatly appreciated!