- Curator Index Management:
- About
- Versions
- Installation
- Running Curator
- Configuration
- Actions
- Options
- allocation_type
- continue_if_exception
- count
- delay
- delete_aliases
- disable_action
- extra_settings
- ignore_empty_list
- ignore_unavailable
- include_aliases
- include_global_state
- indices
- key
- max_age
- max_docs
- max_wait
- max_num_segments
- name
- partial
- refresh
- remote_aws_key
- remote_aws_region
- remote_aws_secret_key
- remote_certificate
- remote_client_cert
- remote_client_key
- remote_filters
- remote_ssl_no_validate
- remote_url_prefix
- rename_pattern
- rename_replacement
- repository
- requests_per_second
- request_body
- retry_count
- retry_interval
- routing_type
- setting
- slices
- skip_repo_fs_check
- timeout
- timeout_override
- value
- wait_for_active_shards
- wait_for_completion
- wait_interval
- warn_if_no_indices
- Filters
- Filter Elements
- Examples
- Security
- Frequently Asked Questions
- Q: How can I report an error in the documentation?
- Q: Can I delete only certain data from within indices?
- Q: Can Curator handle index names with strange characters?
- Q: I’m getting
DistributionNotFoundandentry_pointerrors when I try to run Curator. What am I doing wrong? - Q: Why doesn’t Curator work with AWS Elasticsearch?
- Q: Why am I getting an error message about ASCII encoding?
source
editsource
editThe source from which to derive the index or snapshot age. Can be one of
name, creation_date, or field_stats.
When using the age filtertype, source requires
direction, unit, unit_count,
and additionally, the optional setting, epoch.
name-based ages
editUsing name as the source tells Curator to look for a
timestring within the index or snapshot name, and convert
that into an epoch timestamp (epoch implies UTC).
- filtertype: age source: name direction: older timestring: '%Y.%m.%d' unit: days unit_count: 3
A word about regular expression matching with timestrings
Timestrings are parsed from strftime patterns, like %Y.%m.%d, into regular
expressions. For example, %Y is 4 digits, so the regular expression for that
looks like \d{4}, and %m is 2 digits, so the regular expression is \d{2}.
What this means is that a simple timestring to match year and month, %Y.%m
will result in a regular expression like this: ^.*\d{4}\.\d{2}.*$. This
pattern will match any 4 digits, followed by a period ., followed by 2 digits,
occurring anywhere in the index name. This means it will match monthly
indices, like index-2016.12, as well as daily indices, like
index-2017.04.01, which may not be the intended behavior.
To compensate for this, when selecting indices matching a subset of another
pattern, use a second filter with exclude set to True
- filtertype: pattern kind: timestring value: '%Y.%m' - filtertype: pattern kind: timestring value: '%Y.%m.%d' exclude: True
This will prevent the %Y.%m pattern from matching the %Y.%m part of the
daily indices.
This applies whether using timestring as a mere pattern match, or as part of
date calculations.
creation_date-based ages
editcreation_date extracts the epoch time of index or snapshot creation.
- filtertype: age source: creation_date direction: older unit: days unit_count: 3
field_stats-based ages
editsource can only be field_stats when filtering indices.
field_stats uses the Field Stats API to
calculate either the min_value or the max_value of the field
as the stats_result, and then use that value for age
comparisons.
field must be of type date in Elasticsearch.
- filtertype: age source: field_stats direction: older unit: days unit_count: 3 field: '@timestamp' stats_result: min_value