CODEWITHSUNDEEP
elasticsearchelasticsearch-curator
Linuxea
Linuxea

Reputation: 329

elasticsearch curator delete "all" indices order than 7 days

background:

elasticsearch version 6.2
curator version 5.4.1.

Now I can use curator to delete one index that order 7 days, but I have more than one index and I don't want to create more than one action.yml, such as :

actions:
  1:
    action: delete_indices
    description: >-
        Delete indices older than 7 days (based on index name), for student-prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
        - filtertype: pattern
          kind: prefix
          value: student=
        - filtertype: age
          source: name
          direction: older
          timestring: '%Y-%m-%d'
          unit: days
          unit_count: 7

According to this action.yml, It deletes student=2017-XX-XX. But I have many indices such as teacher, parent and so on. I replace studnet= with *= but doesn't work.

So what can I do? Thank you very much.

Upvotes: 0

Views: 3403

Answers (1)

untergeek
untergeek

Reputation: 863

You try a few things. A few examples include:

  1. You can omit the pattern filtertype, leaving only the age. This might delete other indices with %Y-%m-%d patterns, however. In that case, you might use a different pattern filter, but to exclude patterns you don't want to delete: - filtertype: pattern kind: prefix value: omit_me exclude: true Replacing your pattern filter with this will delete all indices with %Y-%m-%d that are older than 7 days, except indices starting with omit_me.
  2. You might set up a regex instead of a prefix. For example: - filtertype: pattern kind: regex value: '^(student|parent|teacher).*$' This will match indices starting with student, parent, or teacher.

Upvotes: 0

Related Questions