CODEWITHSUNDEEP
elasticsearchelasticsearch-curator
tuk
tuk

Reputation: 6852

Deleting elasticsearch indices which are older than an hour via curator

I am having some indices in elasticsearch whose naming format is elk-console-YYYY-MM-DDtHH. For example:-

elk-console-2016-03-30t14
elk-console-2016-03-30t16

I want to delete all indices which are more than 1 hour old using curator. So I tried executing the below command:-

curator --host localhost delete indices --older-than 1 --time-unit hours --timestring '%Y-%m-%dt%H'

But it is giving me the following ouput:-

2016-04-22 16:27:36,049 INFO      Job starting: delete indices
2016-04-22 16:27:36,058 INFO      Pruning Kibana-related indices to prevent accidental deletion.
2016-04-22 16:27:36,058 WARNING   No indices matched provided args: {'regex': None, 'index': (), 'suffix': None, 'newer_than': None, 'closed_only': False, 'prefix': None, 'time_unit': 'hours', 'timestring': u'%Y-%m-%dt%H', 'exclude': (), 'older_than': 1, 'all_indices': False}
No indices matched provided args: {'regex': None, 'index': (), 'suffix': None, 'newer_than': None, 'closed_only': False, 'prefix': None, 'time_unit': 'hours', 'timestring': u'%Y-%m-%dt%H', 'exclude': (), 'older_than': 1, 'all_indices': False}

I also tried executing the below command:-

curator --host localhost delete indices --older-than 1 --time-unit hours --timestring '%Y-%m-%dt%H' --prefix elk-console-

But still getting the below error:-

2016-04-22 16:48:43,848 INFO      Job starting: delete indices
2016-04-22 16:48:43,856 INFO      Pruning Kibana-related indices to prevent accidental deletion.
2016-04-22 16:48:43,856 WARNING   No indices matched provided args: {'regex': None, 'index': (), 'suffix': None, 'newer_than': None, 'closed_only': False, 'prefix': u'elk-console-', 'time_unit': 'hours', 'timestring': u'%Y-%m-%dt%H', 'exclude': (), 'older_than': 1, 'all_indices': False}
No indices matched provided args: {'regex': None, 'index': (), 'suffix': None, 'newer_than': None, 'closed_only': False, 'prefix': u'elk-console-', 'time_unit': 'hours', 'timestring': u'%Y-%m-%dt%H', 'exclude': (), 'older_than': 1, 'all_indices': False}

Can some one please help me what timestring format should I use in my case?

Environment:-

Upvotes: 0

Views: 3755

Answers (3)

tuk
tuk

Reputation: 6852

As explained by untergeek here

The problem is that it's treating the t as a special character, like a . or a -. This is the first time I've encountered anyone using this syntax, as most people have used hyphens or dots to separate things.

I may back port the fix to 3.x, but chances are good that I will not. I'm adding the fix to the 4.x branch now.

Upvotes: 2

untergeek
untergeek

Reputation: 863

The issue is likely that the index name pattern reflects local time, but Curator does its calculations in UTC. The solution is a software change to allow timezone offsets.

Upvotes: 0

Val
Val

Reputation: 217274

You're almost there, you're simply missing the --prefix option

curator --host localhost delete indices --older-than 1 --time-unit hours --timestring %Y-%m-%dt%H --prefix elk-console

Upvotes: 0

Related Questions