I'm using curator script to purge our data in production.
Currently we are having 2 type of format in ES once is for Production index and another one is pre-prod index.
Basically we keep last 5 week records of production logs and 2 week records of pre-prod logs. we are performing this manually.
By using of below script i could purge both production and pre-prod log more than 5 weeks.
could anyone help me to delete 5 weeks prod log and 2 week per-prod logs.
test-pr-logstash-2022.weekly = production index format
test-na-logstash-2022.weekly = pre-prod index format
actions: 1: action: delete_indices description: >- Delete indices older than 30 days (based on index name), for all indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly. options: ignore_empty_list: True allow_ilm_indices: True timeout_override: continue_if_exception: False disable_action: False filters: - filtertype: age source: name direction: older timestring: '%Y.%W' unit: weeks unit_count: 5 exclude: