# Log Retention **URL:** \ **Category:** Elasticsearch\ **Created:** [November 3, 2017, 2:35pm UTC](https://discuss.elastic.co/t/log-retention/106324 "2017-11-03T14:35:04Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [November 3, 2017, 2:35pm UTC](https://discuss.elastic.co/t/log-retention/106324/1 "2017-11-03T14:35:04Z")
Does Elasticsearch have a default log retention period? If so, how do I change that. If not, what is the best way to go about purging old logs? Many thanks in advance. ---
**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\ **Post date:** [November 3, 2017, 2:57pm UTC](https://discuss.elastic.co/t/log-retention/106324/2 "2017-11-03T14:57:58Z")
As far as I know, the preferred way to manage indices and retention is to use curator [https://www.elastic.co/guide/en/elasticsearch/client/curator/current/about-features.html](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/about-features.html) ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [November 3, 2017, 8:00pm UTC](https://discuss.elastic.co/t/log-retention/106324/3 "2017-11-03T20:00:19Z")
Thanks for the info. I am trying to set up curator based off the example, but when I try the --dry-run, I get the following error: ``` Unable to parse YAML file. Error: mapping values are not allowed here in "", line 20, column 9: kind: prefix ^ ``` I am not sure what's causing the error. I have checked a couple other configs and they appear to be the same. Here is my config file. ``` actions: 1: action: delete_indices description: >- Delete indices older than 2 days (based on index name), for logstash-prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly. options: ignore_empty_list: True timeout_override: continue_if_exception: False disable_action: False filters: - filtertype: pattern kind: prefix value: logstash- exclude: - filtertype: age source: name direction: older timestring: '%Y.%m.%d' unit: days unit_count: 2 exclude: ``` ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [November 3, 2017, 8:36pm UTC](https://discuss.elastic.co/t/log-retention/106324/4 "2017-11-03T20:36:00Z")
You inappropriately indented `kind` and everything beneath it. YAML is _very_ particular about indentation. Your file should look like: ```auto --- actions: 1: action: delete_indices description: >- Delete indices older than 2 days (based on index name), for logstash-prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly. options: ignore_empty_list: True timeout_override: continue_if_exception: False disable_action: False filters: - filtertype: pattern kind: prefix value: logstash- exclude: - filtertype: age source: name direction: older timestring: '%Y.%m.%d' unit: days unit_count: 2 exclude: ``` ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [November 3, 2017, 9:08pm UTC](https://discuss.elastic.co/t/log-retention/106324/5 "2017-11-03T21:08:58Z")
Ok. I tried this: ``` --- # Remember, leave a key empty if there is no value. None will be a string, # # not a Python "NoneType" # # # # Also remember that all examples have 'disable_action' set to True. If you # # want to use this action as a template, be sure to set this to False after # # copying it. actions: 1: action: delete_indices description: >- Delete indices older than 45 days (based on index name), for logstash- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly. options: ignore_empty_list: True timeout_override: continue_if_exception: False disable_action: True filters: - filtertype: pattern kind: prefix value: logstash- exclude: - filtertype: age source: name direction: older timestring: '%Y.%m.%d' unit: days unit_count: 45 exclude: ``` but now I get this error: [root@localhost ~]# curator --dry-run /root/.curator/curator.yml Schema error: extra keys not allowed @ data['actions'] Configuration: Client Configuration: Location: full configuration dictionary: Bad Value: "{1: {'action': 'delete\_indices', 'description': 'Delete indices older than 45 days (based on index name), for logstash- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore\_empty\_list) and exit cleanly.', 'options': {'ignore\_empty\_list': True, 'timeout\_override': None, 'continue\_if\_exception': False, 'disable\_action': True}, 'filters': [{'filtertype': 'pattern', 'kind': 'prefix', 'value': 'logstash-', 'exclude': None}, {'filtertype': 'age', 'source': 'name', 'direction': 'older', 'timestring': '%Y.%m.%d', 'unit': 'days', 'unit\_count': 45, 'exclude': None}]}}", extra keys not allowed @ data['actions']. Check configuration file. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [November 3, 2017, 9:17pm UTC](https://discuss.elastic.co/t/log-retention/106324/6 "2017-11-03T21:17:35Z")
I've also tried following the model at [https://www.elastic.co/guide/en/elasticsearch/client/curator/4.2/ex\_delete\_indices.html](https://www.elastic.co/guide/en/elasticsearch/client/curator/4.2/ex_delete_indices.html) with the "-" under the f in"filters:" and moved everything to line up, but I still get the same error message "...extra keys not allowed @ data ['actions']. Check configuration file." ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [November 3, 2017, 9:35pm UTC](https://discuss.elastic.co/t/log-retention/106324/7 "2017-11-03T21:35:26Z")
Ah: > [@motts](#): > > ```auto > Schema error: extra keys not allowed @ data['actions'] > Configuration: Client Configuration: > > ``` That error is telling you that you specified the same file as both an action file _and_ a client configuration file. Your client definition should be at `/root/.curator/curator.yml`, and your action file (the part you shared above) should be, well, anywhere else, and not named `curator.yml` to make it easier to distinguish. [Here is a client configuration example](https://www.elastic.co/guide/en/elasticsearch/client/curator/5.3/configfile.html): ```auto --- # Remember, leave a key empty if there is no value. None will be a string, # not a Python "NoneType" client: hosts: - 127.0.0.1 port: 9200 url_prefix: use_ssl: False certificate: client_cert: client_key: ssl_no_validate: False http_auth: timeout: 30 master_only: False logging: loglevel: INFO logfile: logformat: default blacklist: ['elasticsearch', 'urllib3'] ``` This is what tells Curator where your cluster is, and how it should connect, log, etc. It is different from the action file. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [November 3, 2017, 9:47pm UTC](https://discuss.elastic.co/t/log-retention/106324/8 "2017-11-03T21:47:52Z")
Awesome, worked like a charm. Thanks a million. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 1, 2017, 9:47pm UTC](https://discuss.elastic.co/t/log-retention/106324/9 "2017-12-01T21:47:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.