Indexing in Curator

Elastic Stack Elasticsearch
1

Hi There,

I’m new to Elasticsearch and trying to create new index in Elasticsearch using curator 5.6.0. im getting error “Schema error: extra keys not allowed @ data['action’]”
Below is the action file configuration

actions:
filebeat:
action: create_index
description: >-
Creating index as "Filebeat" name and it will be Time based indexing
options:
name: '<filebeat-{now/d+1d}>'
extra_settings:
settings:
number_of_shards: 5
number_of_replicas: 2
continue_if_exception: True
disable_action: False

winlogbeat: 
description: >-
  Creating index as "Filebeat" name and it will be Time based indexing
options:
  name: "<winlogbeat-{now/d+1d}>"
  extra_settings:
    settings:
      number_of_shards: 5
      number_of_replicas: 2
      continue_if_exception: True
      disable_action: False
2

Hi @Shafiq,

winlogbeat should create the index for you. I guess you could create it in advance using e.g. curator but I can't think of a benefit doing it that way.

Why exactly do you want to create the index using curator?

3

Hi A_B,

I have installed Elasticsearch 6.5.4 on a windows server. And I want Winlogbeat data and Filebeat data to be stored in Elasticsearch in Time based indexing so that I can delete the data older than 2 months.

4

Ok, then you do not need curator to create indices. Use it only to delete indices older than 2 months. Filebeat and Winlogbeat will create the Elasticsearch indices if they do not exist.

5

Thanks A_B for the help