Prevent curator to delete certain indices

Elastic Stack Elasticsearch
1

Hello all,

we are using the curator to rotate logs ( curator delete indices --older-than XX ) but I was wondering if we could 'lock' certain indices from the automated deletion to allow RCA of an outage without risking to lose them due to the rotation.

Increasing the rotation period is not a nice option as it would increase too much the overall size of the cluster.

Thanks and regards,
Michael

2

you can exclude certain indices from the delete action e.g.:

  - filtertype: pattern
    kind: regex
    value: '<regex-that-matches-index-names>'
    exclude: True

the regex could be something like "^elk|syslog"

3

Thanks for your quick reply!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.