How to delete rollover indices , using deprecated query

Elastic Stack Elasticsearch
1

Hi

Question is basically a copy of this question, but it remains unanswered,

I am considering switching from daily indices style to rollover style. So I was reading your article about how to implement it: And the big one said "Rollover" — Managing Elasticsearch time-based indices efficiently | Elastic Blog

And if I follow the steps , it works like a charm.

However the cleanup of old indices poses a slight problem.

If I run a query to find indices to delete .

GET search-logs/_field_stats?level=indices
{
"fields": ["@timestamp"],
"index_constraints": {
"@timestamp": {
"max_value": {
"lt": "2016/07/03",
"format": "yyyy/MM/dd"
}
}
}
}

I get this response.

#! Deprecation: [_field_stats] endpoint is deprecated! Use [_field_caps] instead or run a min/max aggregations on the desired fields.
{
"_shards": {
"total": 75,
"successful": 75,
"failed": 0
},
.....

So should I ignore the deprecation message or is there a newer supported approach to this? If so , could you please update the article , so it is correct and guides people in the right direction?

I see some support in curator for rollover, but as far as I can tell , it doesnt support cleanup of rollover indices yet?

Regards
Kim

2

Yes, it does. It also has several improvements for that use case coming soon in the next release.

3

Thanks for answering.

I see that Curator is also using the deprecated fields_stats feature at the moment. So I will go with that.

Regards

4

While it is true that Elasticsearch has deprecated field_stats in versions 5.6, and removed it in 6.0, Curator v6 (unreleased at time of posting) will continue to support its own field_stats feature by replacing it with a simple query. It will not be as performant, perhaps, as using the field_stats API was, as it requires iterating over every index individually, but it will achieve the exact same result.