How to delete rollover indices , using deprecated query


Question is basically a copy of this question, but it remains unanswered,

I am considering switching from daily indices style to rollover style. So I was reading your article about how to implement it: And the big one said "Rollover" — Managing Elasticsearch time-based indices efficiently | Elastic Blog

And if I follow the steps , it works like a charm.

However the cleanup of old indices poses a slight problem.

If I run a query to find indices to delete .

GET search-logs/_field_stats?level=indices
"fields": ["@timestamp"],
"index_constraints": {
"@timestamp": {
"max_value": {
"lt": "2016/07/03",
"format": "yyyy/MM/dd"

I get this response.

#! Deprecation: [_field_stats] endpoint is deprecated! Use [_field_caps] instead or run a min/max aggregations on the desired fields.
"_shards": {
"total": 75,
"successful": 75,
"failed": 0

So should I ignore the deprecation message or is there a newer supported approach to this? If so , could you please update the article , so it is correct and guides people in the right direction?

I see some support in curator for rollover, but as far as I can tell , it doesnt support cleanup of rollover indices yet?


Yes, it does. It also has several improvements for that use case coming soon in the next release.

Thanks for answering.

I see that Curator is also using the deprecated fields_stats feature at the moment. So I will go with that.


While it is true that Elasticsearch has deprecated field_stats in versions 5.6, and removed it in 6.0, Curator v6 (unreleased at time of posting) will continue to support its own field_stats feature by replacing it with a simple query. It will not be as performant, perhaps, as using the field_stats API was, as it requires iterating over every index individually, but it will achieve the exact same result.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.