# Skipping action "delete\_indices" due to empty list! Curator

**URL:** <https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118>\
**Category:** Elasticsearch\
**Created:** [August 20, 2018, 9:07am UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118 "2018-08-20T09:07:24Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![saisimo02](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@saisimo02](https://discuss.elastic.co/u/saisimo02)\
**Post date:** [August 20, 2018, 9:07am UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118/1 "2018-08-20T09:07:24Z")

</div>

Hello,  
I wanna delete the older data from elasticsearch, I used curator for that:  
curator.yml

> ```
> client:
> hosts:
> - 127.0.0.1
> port: 9200
> url_prefix:
> use_ssl: False
> certificate:
> client_cert:
> client_key:
> ssl_no_validate: False
> http_auth:
> timeout: 30
> master_only: False
> logging:
> loglevel: INFO
> logfile:
> logformat: default
> blacklist: ['elasticsearch', 'urllib3']
> 
> ```

```
delete_indices.yml
actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 45 days (based on index name), for logstash-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: logstash-
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 1
      exclude:
# - filtertype: space
# disk-space: 65
# use_age: True
# source: creation_date

```

when I run this cmd I got error message:

> ```
> curator delete_indices.yml --config curator.yml --dry-run
> 2018-08-20 10:29:10,012 INFO Preparing Action ID: 1, "delete_indices"
> 2018-08-20 10:29:10,017 INFO Trying Action ID: 1, "delete_indices": Delete indices older than 45 days (based on index name), for logstash- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
> 2018-08-20 10:29:10,030 INFO Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>
> 2018-08-20 10:29:10,031 INFO Action ID: 1, "delete_indices" completed.
> 2018-08-20 10:29:10,031 INFO Job completed.
> 
> ```

my logstash.conf

> ```
> output{
> 
> elasticsearch
> {
> action => "index"
> hosts => ["127.0.0.1:9200"]
> index => "test-%{+YYYY.MM.dd}"
> }
> stdout{codec=>rubydebug}}
> 
> ```

```
curl -XGET 'localhost:9200/_cat/indices?v&pretty'
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .monitoring-es-6-2018.08.20 RW_PLI8WT3WvKHPFFaymFg 1 0 62 0 56.4kb 56.4kb
green open .kibana qDdB3taHR_qvR79nVNPrWw 1 0 39 3 87.6kb 87.6kb
yellow open test-2018.08.20 C4p4cFVTROK8gyT4npgYjg 5 1 141543 0 73.1mb 73.1mb
yellow open test-2018.08.17 XlDW0lapQH2gLYm38rjCoQ 5 1 411935 0 211.1mb 211.1mb

```

Any idea whats wrong!

Thank you a lot

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [August 20, 2018, 12:42pm UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118/2 "2018-08-20T12:42:58Z")

</div>

> [@saisimo02](#):
>
> Any idea whats wrong!

Yep. Here you are:

> [@saisimo02](#):
>
> ```auto
> filters: 
> - filtertype: pattern 
> kind: prefix 
> value: logstash-
> 
> ```

Combine that with:

> [@saisimo02](#):
>
> ```auto
> index => "test-%{+YYYY.MM.dd}"
> 
> ```

And that's why it doesn't work. Your `pattern` filter is only going to work on indices named `logstash-*`, but your logstash is only creating indices named `test-*`.

---

<div class="post-metadata">

**Author:** ![saisimo02](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@saisimo02](https://discuss.elastic.co/u/saisimo02)\
**Post date:** [August 20, 2018, 1:07pm UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118/3 "2018-08-20T13:07:36Z")

</div>

Thank you, it's working now, I have another question to delete data if disk-space is more than 65go, could I use this configuration:

```auto
# - filtertype: space
# disk_space: 65
# use_age: True
# source: creation_date

```

Thank you

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [August 20, 2018, 1:20pm UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118/4 "2018-08-20T13:20:12Z")

</div>

I would remove the `age` filter in that case, but yes, you understand the concept correctly.

If you neglect to remove the `age` filter, the combination of `age` and `space` filters will not delete any but those both older than `1` `days` _and_ greater than `65` G.

---

<div class="post-metadata">

**Author:** ![saisimo02](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@saisimo02](https://discuss.elastic.co/u/saisimo02)\
**Post date:** [August 20, 2018, 1:25pm UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118/5 "2018-08-20T13:25:13Z")

</div>

I think I misunderstood the use of this filtertype, I would like to delete oldest data after a week but if there is a risk to use 80% of my local disk ( let's say approximately 65go) in this case I will also delete data. So I will combine the age of data and the size of all data indexed on elasticsearch.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [August 20, 2018, 2:16pm UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118/6 "2018-08-20T14:16:34Z")

</div>

What you should do then, is have 2 actions. This will guarantee both conditions. The first covers the week of retention. The second will always delete the oldest indices in excess of 65G, should that condition prove true. If not, nothing will happen.

### Sample configuration:

```auto
actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 7 days
    options:
      ignore_empty_list: true
    filters:
    - filtertype: pattern
      kind: prefix
      value: logstash-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7
  2:
    action: delete_indices
    description: >-
      Delete indices in excess of 65 gigabytes
    options:
      ignore_empty_list: true
    filters:
    - filtertype: pattern
      kind: prefix
      value: logstash-
    - filtertype: space
      disk-space: 65
      use_age: true
      source: creation_date

```

---

<div class="post-metadata">

**Author:** ![saisimo02](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@saisimo02](https://discuss.elastic.co/u/saisimo02)\
**Post date:** [August 20, 2018, 2:20pm UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118/7 "2018-08-20T14:20:20Z")

</div>

Great! Thanks a lot 😊

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2018, 2:20pm UTC](https://discuss.elastic.co/t/skipping-action-delete-indices-due-to-empty-list-curator/145118/8 "2018-09-17T14:20:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.