# How do I know if curator is cleaning up? (SOLVED) **URL:** \ **Category:** Elasticsearch\ **Created:** [September 9, 2015, 3:23am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887 "2015-09-09T03:23:56Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [September 9, 2015, 3:23am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/1 "2015-09-09T03:23:56Z")
Hi, I was wondering if someone could clear up a question I have with curator. So I installed Curator ``` sudo apt-get install python-pip ``` then ``` pip install elasticsearch-curator ``` then ``` crontab -e ``` then at the end of the line added ``` 20 0 * * * /usr/local/bin/curator --host 127.0.0.1 -d 2 -c 1 ``` What I wanted to see if it cleans my logs to leave disk space or am I understanding the wrong concept of how curator works? Because When I go to Kibana I can still look for logs older then 5 days I thought it would of deleted it. Thank you ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 9, 2015, 3:52am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/2 "2015-09-09T03:52:37Z")
Have you tried running it by hand? Because I'd expect Curator to complain about the command line syntax. The command should resemble `curator delete indices --older-than 5 --time-unit days`. To keep track of what Curator actually does, use the `--logfile` option to have it log everything to a file. ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [September 9, 2015, 6:51pm UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/3 "2015-09-09T18:51:07Z")
Hi Magnusbaeck Thank you for your reply. Well I followed this guide > **[Removing Old Records for Logstash / Elasticsearch / Kibana](http://www.ragingcomputer.com/2014/02/removing-old-records-for-logstash-elasticsearch-kibana)** > > Edit: This post is pretty old and Elasticsearch/Logstash/Kibana have evolved a lot since it was written. Part 4 of 4 - Part 1 - Part 2 - Part 3 Now that you've got all your logs flying through logstash into elasticsearch, how to remove old records... What do you mean running it by hand? Do you mean something like checking if the code is working? This is how I would check if Logstash is working Ex: ``` tail -f/var/log/logstash/logstash.stdout ``` Thank you ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 9, 2015, 8:01pm UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/4 "2015-09-09T20:01:33Z")
> Well I followed this guide > [http://www.ragingcomputer.com/2014/02/removing-old-records-for-logstash-elasticsearch-kibana](http://www.ragingcomputer.com/2014/02/removing-old-records-for-logstash-elasticsearch-kibana) That guide is obsolete and won't work with Curator 3.0 and later. > What do you mean running it by hand? I mean running the command in a terminal and making sure it works as expected before sticking it in a cron job. And again, make sure you use `--logfile` to get a log from the execution. I enable debug-level logging, enable the Logstash log format, and push the logs into Elasticsearch. ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [September 9, 2015, 9:39pm UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/5 "2015-09-09T21:39:58Z")
Hi thank you again for your reply I got it to work. This line deletes 5 days of logs perfect ``` curator delete indices --older-than 5 --time-unit days --timestring %Y.%m.%d ``` Now That I know its working and want to implement on the cron job would I add it underneath like after typing ``` crobtab -e ``` then type ``` curator --host localhost delete indices --older-than 5 --time-unit days --timestring %Y.%m.%d ``` But I think theres an error on the syntax for the cron job. ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f06828db2e398f7be6ea342658441d47246f8b9c.png) See pictures Thank you ![](https://us1.discourse-cdn.com/elastic/original/2X/f/fe76c99f5412e100f0e47edcfe2ded3e96b48554.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d4bfaba69ea8e95c498a57f7843abe57016408df.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 10, 2015, 3:39am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/6 "2015-09-10T03:39:29Z")
A line in a user's crontab file always starts with a five-column specification of _when_ to run the job. Study the article you used from the beginning and what you initially had in your crontab. ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [September 11, 2015, 2:42am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/7 "2015-09-11T02:42:44Z")
Hi there Magnus Thanks for the reply So I think I have figured it out on my crontab -e correct me if im wrong ``` * * * * * /usr/local/bin/curator delete indices --older-than 1 --time-unit days --timestring '\%Y.\%m.\%d' ``` which this indicates to run every minute to delete any logs older then one day I ran this command to see if cron was working which it was deleted all my logs besides today. Next Now That i know it works I run ``` 20 0 * * * /usr/local/bin/curator delete indices --older-than 7 --time-unit days --timestring '\%Y.\%m.\%d' ``` This line indicates to run curator at 20 minutes past midnight and delete any logs older then 7 days So if I have logged day 1,2,3,4,5,6,7 and when day 8 logs curator should delete the day 1 log at 20min past midnight? So the next day it should be logs 2,3,4,5,6,7,8? Thank you ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 11, 2015, 3:39am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/8 "2015-09-11T03:39:17Z")
Yes, that's right. ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [September 12, 2015, 2:34am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/9 "2015-09-12T02:34:15Z")
Thank you again Magnus I will be sure to add this on my guide to help others 😄 ---
**Author:** ![prasanna\_kumar](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@prasanna\_kumar](https://discuss.elastic.co/u/prasanna_kumar)\ **Post date:** [July 14, 2016, 7:50am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/10 "2016-07-14T07:50:32Z")
hey while running this command (curator delete indices --older-than 5 --time-unit days) am getting the following error (Error: no such option: --older-than) what to do? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 14, 2016, 9:17am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/11 "2016-07-14T09:17:14Z")
@prasanna_kumar, please start a new thread for your unrelated question. ---
**Author:** ![nanshan](https://avatars.discourse-cdn.com/v4/letter/n/858c86/32.png) [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Post date:** [August 25, 2016, 12:16am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/12 "2016-08-25T00:16:08Z")
> [@killmasta93](#): > > 20 0 \* \* \* /usr/local/bin/curator delete indices --older-than 7 --time-unit days --timestring '%Y.%m.%d' Should you add `--host` to specify which host to run curator? ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [October 22, 2016, 3:56pm UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/13 "2016-10-22T15:56:51Z")
no need to add the host but whats odd.. that it wont work anymore this command ``` curator delete indices --older-than 5 --time-unit days --timestring %Y.%m.%d ``` which shows (Error: no such option: --older-than) which is odd haven't touch curator for over months ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 22, 2016, 4:13pm UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/14 "2016-10-22T16:13:26Z")
@killmasta93 You've probably triggered an upgrade. Curator 3 was all command-line, while Curator 4 uses YAML configuration files. See [https://www.elastic.co/guide/en/elasticsearch/client/curator/current/index.html](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/index.html) for the current documentation on Curator. ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [October 23, 2016, 1:52am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/15 "2016-10-23T01:52:14Z")
o no...i dont even know when it updated by itself ☹ its running 4.0.0 is there a way to downgrade it? ☹ ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 23, 2016, 3:12am UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/16 "2016-10-23T03:12:54Z")
It's not possible to upgrade from 3 to 4 by accident if you installed via YUM or APT as the repositories are different. I presume it may have happened via a `pip` upgrade statement. You can downgrade with `pip install -U elasticsearch-curator==3.5.1` ---
**Author:** ![killmasta93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/killmasta93/32/36022_2.png) [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Post date:** [October 23, 2016, 4:57pm UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/17 "2016-10-23T16:57:45Z")
> [@theuntergeek](#): > > pip install -U elasticsearch-curator==3.5.1 Thank you soo much 🙂 im not much for updates, still on the old kibana ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:10pm UTC](https://discuss.elastic.co/t/how-do-i-know-if-curator-is-cleaning-up-solved/28887/18 "2017-07-05T22:10:19Z")