# Prevent curator to delete certain indices

**URL:** https://discuss.elastic.co/t/prevent-curator-to-delete-certain-indices/99379
**Category:** Elasticsearch
**Created:** [September 5, 2017, 7:05am UTC](https://discuss.elastic.co/t/prevent-curator-to-delete-certain-indices/99379 "2017-09-05T07:05:38Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![tyyko](https://avatars.discourse-cdn.com/v4/letter/t/e9c0ed/32.png) [@tyyko](https://discuss.elastic.co/u/tyyko)
#### Post date: [September 5, 2017, 7:05am UTC](https://discuss.elastic.co/t/prevent-curator-to-delete-certain-indices/99379/1 "2017-09-05T07:05:39Z")

</div>

Hello all,

we are using the curator to rotate logs ( curator delete indices --older-than XX ) but I was wondering if we could 'lock' certain indices from the automated deletion to allow RCA of an outage without risking to lose them due to the rotation.

Increasing the rotation period is not a nice option as it would increase too much the overall size of the cluster.

Thanks and regards,  
Michael

---

<div class="post-metadata">

### Author: ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)
#### Post date: [September 5, 2017, 8:14am UTC](https://discuss.elastic.co/t/prevent-curator-to-delete-certain-indices/99379/2 "2017-09-05T08:14:58Z")

</div>

you can exclude certain indices from the delete action e.g.:

```
  - filtertype: pattern
    kind: regex
    value: '<regex-that-matches-index-names>'
    exclude: True

```

the regex could be something like "^elk|syslog"

---

<div class="post-metadata">

### Author: ![tyyko](https://avatars.discourse-cdn.com/v4/letter/t/e9c0ed/32.png) [@tyyko](https://discuss.elastic.co/u/tyyko)
#### Post date: [September 5, 2017, 2:09pm UTC](https://discuss.elastic.co/t/prevent-curator-to-delete-certain-indices/99379/3 "2017-09-05T14:09:28Z")

</div>

Thanks for your quick reply!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 3, 2017, 2:09pm UTC](https://discuss.elastic.co/t/prevent-curator-to-delete-certain-indices/99379/4 "2017-10-03T14:09:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
