策展人找不到我的索引

Question

试图让策展人清理我命名为 "syslog"

的索引

我有这个动作 yml:

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: syslog
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: hours
      unit_count: 1
      exclude:

我尝试了 "hours" 和 "days" 但我一直收到策展人的消息：

 Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>

Answer 1

您告诉 Curator 您希望它识别前缀值为 syslog 的索引，并且索引名称中还有 Year.Month.Day 时间字符串。这将匹配，例如，如果索引名称是 syslog-2017.03.14。但是如果索引的名字只有syslog，这个过滤集就不会匹配。

也许您想了解相对于索引创建时间的索引年龄。在这种情况下，您将设置

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: regex
      value: '^syslog$'
    - filtertype: age
      source: creation_date
      direction: older
      unit: hours
      unit_count: 1

这将匹配仅名为 syslog 的索引，其 creation_date 至少比执行时间早一小时。

策展人找不到我的索引

Curator not finding my index

elasticsearch

elasticsearch-curator

elastic-stack