# Weekly index cleanup using curator 5.8
**URL:** https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354
**Category:** Elasticsearch
**Tags:** curator
**Created:** [March 16, 2021, 11:17am UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354 "2021-03-16T11:17:01Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)
#### Post date: [March 16, 2021, 11:17am UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354/1 "2021-03-16T11:17:01Z")
I am trying to clean weekly indexes older than 4 weeks on elasticsearch 7.x however not able to figure out the curator config
Current config is
```
- filtertype: period
period_type: relative
source: name
range_from: -4
range_to: 0
timestring: '%Y.%m.%d'
unit: weeks
week_starts_on: monday
```
Per my understanding ( Correct if i am wrong ), this should target 4 weeks of worth index backdated from today.
I have an index for testing which i believe should be removed however its not being taken as part of cleanup criteria
`2021-03-16 10:15:03,326 DEBUG curator.indexlist filter_by_age:550 Index "inf_os_logs-2021.11" does not meet provided criteria. Removing from list.`
Could anyone suggest the right way to remove index older than 4 weeks with the following naming convention `inf_XXXXXXX_logs-YYYY-WW` as the template.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 16, 2021, 12:34pm UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354/2 "2021-03-16T12:34:32Z")
Your timestring looks for a date pattern, not a week. I suspect it should be `%Y.%W` or similar
---
### Author:  [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)
#### Post date: [March 16, 2021, 2:00pm UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354/3 "2021-03-16T14:00:19Z")
Thank you , seems to be working. I am testing it out.
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [March 16, 2021, 2:16pm UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354/4 "2021-03-16T14:16:28Z")
Please note that if using ISO weeks, your [`timestring`](https://www.elastic.co/guide/en/elasticsearch/client/curator/5.8/fe_timestring.html#_strftime_2) will look like `%G-%V` instead. Python's `datetime` doesn't do ISO weeks without some extra calculations. A community contributor to Python added these and some extra code to compensate for ISO weeks.
---
### Author:  [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)
#### Post date: [March 18, 2021, 11:33am UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354/5 "2021-03-18T11:33:12Z")
While testing this out i have found that the curator is targeting indices currently in the 4 weeks as well
`2021-03-18 06:05:27,974 DEBUG curator.indexlist __excludify:58 Remains in actionable list: Index "ams_fip-2021.02.25" age (1610323200), direction: "older", point of reference, (1613642727)`
The age of the index seems to be different from the one shown in the elasticsearch and this is causing it to include index which are still needed
**Date calculated by curator**
GMT: Monday, January 11, 2021 12:00:00 AM
Your time zone: Monday, January 11, 2021 5:30:00 AM GMT+05:30
Relative: 2 months ago
**Date shown on index**
GMT: Thursday, February 25, 2021 12:00:02.031 AM
Your time zone: Thursday, February 25, 2021 5:30:02.031 AM GMT+05:30
Relative: 21 days ago
Am i missing anything ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 18, 2021, 12:41pm UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354/6 "2021-03-18T12:41:31Z")
That is a daily index and I guess the month is interpreted as week number? You need to set prefixes and filters so you only catch weekly indices with a weekly delete step.
---
### Author:  [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)
#### Post date: [March 18, 2021, 12:58pm UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354/7 "2021-03-18T12:58:51Z")
This is the current config, i have created 2 actions ( one for daily and other for weekly ). It appears the weekly is recognising the correct time frame daily is not.
```
---
# Remember, leave a key empty if there is no value. None will be a string,
# not a Python "NoneType"
#
# Also remember that all examples have 'disable_action' set to True. If you
# want to use this action as a template, be sure to set this to False after
# copying it.
actions:
1:
action: delete_indices
description: >-
Test
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: '.*'
exclude:
- filtertype: creation_date
source: name
direction: older
timestring: '%Y.%m.%d'
unit: seconds
unit_count: 2678400
exclude:
actions:
2:
action: delete_indices
description: >-
Test-2
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: '.*'
exclude:
- filtertype: age
source: name
direction: older
timestring: '%Y.%W'
unit: weeks
unit_count: 4
exclude:
```
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [March 18, 2021, 2:40pm UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354/8 "2021-03-18T14:40:43Z")
@Christian_Dahlqvist is correct. The `timestring` patterns only get translated (at first) into digit matching regular expressions. `%Y.%m.%d` turns into `\d{4}\.\d{2}\.\d{2}` and `%Y.%W` turns into `\d{4}\.\d{2}`. Since the `2021.02` of `2021.02.25` matches both regular expressions, it is attempting to evaluate both.
To get around this, as suggested, you need to add a filter to omit `year.month.day` indices from your weekly index action.
```auto
2:
action: delete_indices
description: >-
Test-2
options:
ignore_empty_list: True
filters:
- filtertype: pattern
kind: regex
value: '^.*\d{4}\.\d{2}\.\{d}2$'
exclude: true
- filtertype: age
source: name
direction: older
timestring: '%Y.%W'
unit: weeks
unit_count: 4
```
The first filter in this example will exclude indices that end with a `year.month.day` pattern (i.e. 4 digits, a period, 2 digits, a period, and 2 more digits).
As an aside:
1. You do not need to repeat `actions` for each action. Just preserve the indent level.
2. You do not need to have an all inclusive `pattern` filter to catch everything `.*`. This is implied. All indices are included until filtered out (at least in the present version of Curator).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 15, 2021, 2:40pm UTC](https://discuss.elastic.co/t/weekly-index-cleanup-using-curator-5-8/267354/9 "2021-04-15T14:40:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.