Use Curator to delete indices before a specific date

Elastic Stack Elasticsearch
1

Hi,

I've easily found how to delete indices older than X days, but I'd like to delete indices before a specific date.

Should I use "epoch" in the "age" filter ?

Thanks

2

HI Jeremy,

Yes we can perform index deletion based on the date we are specifying with combination of index prefix param.

please check this once : https://github.com/elastic/curator/issues/305

Hope this helps!!

phani

3

I'm not sure the previous answer covers the use case you describe. Are you asking if you can delete an index on or before an exact date? Curator typically deals with dates relative to the time of execution. It's not designed (at least not currently) to be able to handle deterministic things like that.

It might be possible to make something like that, but it isn't currently built in to Curator. You might be able to achieve what you want with the epoch field, but that's certainly not an elegant solution.

What's your use case? Why do you need to identify indices to delete with a specific expiration date, as it were?

4

I'm setting up an ELK stack for log collection. Filebeat is mostly responsible for shipping logs from many servers and services to Logstash. Filebeat's processes are catching up on log files and a lot of data is useless to us before a specific date.

Since Curator is not able to do this elegantly (which is a perfectly reasonable answer), I'll do this semi-manually with a bash script.

I'll keep using Curator to clean old indices based on relative age.

Thanks