# Unable to delete indicies using Curator

**URL:** https://discuss.elastic.co/t/unable-to-delete-indicies-using-curator/127833
**Category:** Elasticsearch
**Created:** [April 12, 2018, 1:49pm UTC](https://discuss.elastic.co/t/unable-to-delete-indicies-using-curator/127833 "2018-04-12T13:49:36Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![CDawson1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cdawson1/32/32694_2.png) [@CDawson1](https://discuss.elastic.co/u/CDawson1)
#### Post date: [April 12, 2018, 1:49pm UTC](https://discuss.elastic.co/t/unable-to-delete-indicies-using-curator/127833/1 "2018-04-12T13:49:36Z")

</div>

I've gone through about every thread on the topic, and have not found any answer or fix to this issue. I've just installed curator today (5.5.1) on top of an existing ELK 6.0 instance.

I've configured my files using the defaults as that really suits our environment...

My action file...

```auto
actions:
  1:
    action: delete_indices
      description: >-
          Delete indices older than 30 days (based on index name), for logstash-
          prefixed indices. Ignore the error if the filter does not result in an
          actionable list of indices (ignore_empty_list) and exit cleanly.
      options:
        ignore_empty_list: False
        disable_action: False
      filters:
      - filtertype: pattern
        kind: prefix
        value: logstash-
      - filtertype: age
        source: name
        direction: older
        timestring: '%Y.%m.%d'
        unit: days
        unit_count: 30

```

And my configuration...

```auto
client:
  hosts:
    - xxx.xxx.xxx.168
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: False
  http_auth:
  timeout: 30
  master_only: False

logging:
  loglevel: DEBUG
  logfile: '/var/log/curator'
  logformat: default
  blacklist: []

```

The blacklist was done as another suggestion.

The log in question:

```auto
2018-04-12 14:35:41,394 DEBUG curator.cli run:108 Client and logging options validated.
2018-04-12 14:35:41,394 DEBUG curator.cli run:112 default_timeout = 30
2018-04-12 14:35:41,394 DEBUG curator.cli run:116 action_file: ./delete_30.yml

```

My indicies:

```auto
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open logstash-2017.11.20 0RhQJVvfQUOuUCkR7w7VYg 5 1 3332817 0 479.5mb 479.5mb
yellow open logstash-2018.01.22 EAesN1P5S-CW25G8I8458A 5 1 4416574 0 645.9mb 645.9mb
yellow open logstash-2018.01.30 NlXgCEWdS6mGlAwYon_L3Q 5 1 3873730 0 585.3mb 585.3mb
yellow open logstash-2017.11.28 2vi8fETSReiB_hQUg1XdvA 5 1 4323272 0 680.3mb 680.3mb
etc...

```

The log files are from the dry runs.

So I'm at a loss as to why this isn't working. As mentioned, I've seen plenty on this topic, but nothing seems to have addressed this issue.

TIA

---

<div class="post-metadata">

### Author: ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)
#### Post date: [April 12, 2018, 2:17pm UTC](https://discuss.elastic.co/t/unable-to-delete-indicies-using-curator/127833/2 "2018-04-12T14:17:04Z")

</div>

Hey,

It could just be a copy/paste formatting issue but your actions file looks incorrectly indented to me:

```
actions:
  1:
    action: delete_indices
      description: >-
          Delete indices older than 30 days (based on index name), for logstash-
          prefixed indices. Ignore the error if the filter does not result in an
          actionable list of indices (ignore_empty_list) and exit cleanly.
      options:
        ignore_empty_list: False
        disable_action: False
      filters:
      - filtertype: pattern
        kind: prefix
        value: logstash-
      - filtertype: age
        source: name
        direction: older
        timestring: '%Y.%m.%d'
        unit: days
        unit_count: 30

```

All the keys should be aligned with the action, as per below:

```
actions:
  1:
    action: delete_indices
    description: >-
        Delete indices older than 30 days (based on index name), for logstash-
        prefixed indices. Ignore the error if the filter does not result in an
        actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: logstash-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 30
```

---

<div class="post-metadata">

### Author: ![CDawson1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cdawson1/32/32694_2.png) [@CDawson1](https://discuss.elastic.co/u/CDawson1)
#### Post date: [April 12, 2018, 2:32pm UTC](https://discuss.elastic.co/t/unable-to-delete-indicies-using-curator/127833/3 "2018-04-12T14:32:49Z")

</div>

Oh man...yeah. Thanks for that. I'll look for another thread where it looked as though my indents were correct, but yeah, sure enough, that was it.

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2018, 2:33pm UTC](https://discuss.elastic.co/t/unable-to-delete-indicies-using-curator/127833/4 "2018-05-10T14:33:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
