Curator: Trying to delete indices using curator

[Howard-Chang]

Hi everyone,
I am new in curator. My problem is that first time I run this command :
curator --config curator.yml delete_indices.yml
and it works to delete some data.
curator.yml:
`---
client:
hosts:
- 127.0.0.1
port: 9200
url_prefix:
use_ssl: False
certificate:
client_cert:
client_key:
ssl_no_validate: False
http_auth:
timeout: 30
master_only: False

logging:
loglevel: INFO
logfile:
logformat: default
blacklist: ['elasticsearch', 'urllib3'] delete_indices.yml:
actions:
1:
action: delete_indices
description: >-
Delete indices older than 1 days (based on index name), for logstash-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: logstash-
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 1`

but second time after I input some data to Elasticserch, and run the command .
it shows:
E:\ELK\elasticsearch-curator-5.2.0-amd64\curator-5.2.0-amd64>curator --config cu
rator.yml delete_indeces.yml
2017-09-25 23:26:04,648 INFO Preparing Action ID: 1, "delete_indices"
2017-09-25 23:26:04,679 INFO Trying Action ID: 1, "delete_indices": Delete
indices older than 1 days (based on index name), for logstash- prefixed indices.
Ignore the error if the filter does not result in an actionable list of indices
(ignore_empty_list) and exit cleanly.
2017-09-25 23:26:04,695 INFO Skipping action "delete_indices" due to empty
list:
2017-09-25 23:26:04,695 INFO Action ID: 1, "delete_indices" completed.
2017-09-25 23:26:04,710 INFO Job completed.

However when I run the command :
E:\ELK\elasticsearch-curator-5.2.0-amd64\curator-5.2.0-amd64>curator_cli show_in
dices
.kibana
logstash-2017-08-09
logstash-2017-08-23
logstash-2017-09-19
logstash-2017-09-25

It represent that there's some data,but curator didn't delete anymore.
thanks in advance.

[untergeek]

If you see that in the show_indices command, and you immediately run the delete_indices again, do those get deleted? Or does it show indices, but still say they're not there?

In the event that they are deleted again, then this indicates that Logstash is receiving old data that is going into accordingly named indices.

If it shows up in show_indices, it _should_ also show up in Curator's regular logs, as they share the same code.

[Howard-Chang]

yes. it show indices, but when I run the command:
curator --config curator.yml delete_indices.yml
it still say they're not there.

[Howard-Chang]

it always show this :
E:\ELK\elasticsearch-curator-5.2.0-amd64\curator-5.2.0-amd64>curator --config cu
rator.yml delete_indeces.yml
2017-09-26 11:16:24,912 INFO Preparing Action ID: 1, "delete_indices"
2017-09-26 11:16:24,928 INFO Trying Action ID: 1, "delete_indices": Delete
indices older than 1 days (based on index name), for logstash- prefixed indices.
Ignore the error if the filter does not result in an actionable list of indices
(ignore_empty_list) and exit cleanly.
2017-09-26 11:16:24,959 INFO Skipping action "delete_indices" due to empty
list:
2017-09-26 11:16:24,959 INFO Action ID: 1, "delete_indices" completed.
2017-09-26 11:16:24,959 INFO Job completed.

[Howard-Chang]

I check the log in kibana. it actually exists some log in elasticsearch.
.kibana
logstash-2017-08-09
logstash-2017-08-23
logstash-2017-09-19
logstash-2017-09-25

[untergeek]

Ah... Found it. You have specified:

timestring: '%Y.%m.%d'

in your age filter, but your index names have a pattern of:

timestring: '%Y-%m-%d'

[Howard-Chang]

Oh haha.. thank you a lot 👍

[Howard-Chang]

sorry may I ask another question.
I want to delete log per week automatically , and my pc is windows. How can I do it : (

[Howard-Chang]

I have done it by schedule tool thank u : )