Old indices wont delete

Elastic Stack Elasticsearch
1

All, i'm trying to delete old indices but can't get it work. Please help me on this issue.

Error:

2018-02-19 21:34:40,977 INFO Preparing Action ID: 1, "delete_indices"
2018-02-19 21:34:40,997 INFO Trying Action ID: 1, "delete_indices": Delete indices older than 30 days (based on index name), for tomcat- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
2018-02-19 21:34:41,138 INFO Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>
2018-02-19 21:34:41,138 INFO Action ID: 1, "delete_indices" completed.
2018-02-19 21:34:41,138 INFO Job completed.

My action file:
actions:
1:
action: delete_indices
description: >-
Delete indices older than 30 days (based on index name), for tomcat-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:

  • filtertype: pattern
    kind: prefix
    value: logstash-
    exclude:
  • filtertype: age
    source: name
    direction: older
    timestring: '%Y.%m.%d'
    unit: days
    unit_count: 1
    exclude: True

My conf.yml

client:
hosts:

  • ${ELK_HOST}
    port: 9200
    url_prefix:
    use_ssl: False
    certificate:
    client_cert:
    client_key:
    ssl_no_validate: False
    http_auth:
    timeout: 30
    master_only: False
    logging:
    loglevel: INFO
    logfile:
    logformat: default
    blacklist: ['elasticsearch', 'urllib3']

When i do df -h

Filesystem Size Used Avail Use% Mounted on
devtmpfs 3.9G 68K 3.9G 1% /dev
tmpfs 3.9G 0 3.9G 0% /dev/shm
/dev/xvda1 7.8G 6.2G 1.6G 80% /
/dev/xvdf 985G 572G 363G 62% /var/lib/docker
overlay 985G 572G 363G 62% /var/lib/docker/overlay2/9f13215541c68fb3db4a96e45667554c4958bcc50d2bd5dc228d73610742bfed/merged

2

Please format your code, logs or configuration files using </> icon as explained in this guide and not the citation button. It will make your post more readable.

Or use markdown style like:

```
CODE
```

There's a live preview panel for exactly this reasons.

Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.
Please update your post.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.