Curator: Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>

[marouen10]

Dear all,

I tried to use curator to delete indices for Elasticsearch "older than 10 days", but I always get Skipping action "delete_indices" due to empty list: .

curator --config /etc/curator/curator.config /etc/curator/del-old-logs.yml
2019-12-04 03:47:17,361 INFO Preparing Action ID: 1, "delete_indices"
2019-12-04 03:47:17,361 INFO Creating client object and testing connection
2019-12-04 03:47:17,364 INFO Instantiating client object
2019-12-04 03:47:17,365 INFO Testing client connectivity
2019-12-04 03:47:17,368 INFO Successfully created Elasticsearch client object with provided settings
2019-12-04 03:47:17,369 INFO Trying Action ID: 1, "delete_indices": Delete indices older than 90 days (based on index name), for logstash- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
2019-12-04 03:47:17,396 INFO Skipping action "delete_indices" due to empty list:
2019-12-04 03:47:17,396 INFO Action ID: 1, "delete_indices" completed.
2019-12-04 03:47:17,397 INFO Job completed.
Here the del-old-logs.yml settings:

actions:
1:
action: delete_indices
description: >-
Delete indices older than 90 days (based on index name), for logstash-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: False
filters:
- filtertype: pattern
kind: prefix
value: logstash-
exclude:
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 10
exclude:

The logstash indexes are still displayed and not deleted.

curator_cli show_indices
2019-12-04 03:46:59,848 INFO Instantiating client object
2019-12-04 03:46:59,849 INFO Testing client connectivity
2019-12-04 03:46:59,853 INFO Successfully created Elasticsearch client object with provided settings
.kibana_1
.kibana_task_manager
logstash-2019.10.04-000001
logstash-2019.11.03-000002
logstash-2019.12.03-000003

curl -XGET 'localhost:9200/_cat/indices?v&pretty'
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .kibana_task_manager X7EUsto6S7eFI64VfP3oOw 1 0 2 0 31.3kb 31.3kb
yellow open logstash-2019.11.03-000002 cQ2U8JC3RZ2sQXNtrWGesQ 1 1 228373323 0 32gb 32gb
yellow open logstash-2019.12.03-000003 pv927GgbSBeRtq3oZxDFbw 1 1 7864141 0 1.1gb 1.1gb
yellow open logstash-2019.10.04-000001 V2XZ370dQJ6wg43J36kfCA 1 1 219073641 0 27.2gb 27.2gb
green open .kibana_1 n4wwHCrIRma2kOVel_juBg 1 0 707 14 417.1kb 417.1kb

Do you know the root cause ?
Thank you in advance

[untergeek]

If you run Curator with loglevel set to DEBUG you will likely see an extra message that indicates that these logstash indices have an ILM (Index Lifecycle Management) policy affixed. Curator will not operate against indices with an ILM policy unless you set allow_ilm_indices: true.

Read more here.

[marouen10]

If you run Curator with loglevel set to DEBUG you will likely see an extra message that indicates that these logstash indices have an ILM (Index Lifecycle Management) policy affixed. Curator will not operate against indices with an ILM policy unless you set allow_ilm_indices: true.

Read more here.

Thanks a lot.
This solved the issue.

[kasim457]

If you run Curator with loglevel set to DEBUG you will likely see an extra message that indicates that these logstash indices have an ILM (Index Lifecycle Management) policy affixed. Curator will not operate against indices with an ILM policy unless you set allow_ilm_indices: true.

Read more here.

@untergeek , I added same settings in my action.yaml section ( values.yaml) and did not see any progress. Could you guide me what is missing in action.yaml to enforce deletion action.

2021-03-08 01:00:07,786 DEBUG          curator.indexlist       empty_list_check:226  Checking for empty list
2021-03-08 01:00:07,787 INFO                 curator.cli                    run:180  Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>
2021-03-08 01:00:07,787 INFO                 curator.cli                    run:201  Action ID: 1, "delete_indices" completed.
2021-03-08 01:00:07,787 INFO                 curator.cli                    run:202  Job completed.

Here is the output of acton.yaml

action_file_yml: |-
    ---
    actions:
      1:
        action: delete_indices
        description: "Clean up ES by deleting old indices"
        options:
          timeout_override:
          continue_if_exception: False
          disable_action: False
          allow_ilm_indices: true
          ignore_empty_list: True
        filters:
        - filtertype: age
          source: name
          direction: older
          timestring: '%Y.%m.%d'
          unit: days
          unit_count: 90
          field:
          stats_result:
          epoch:
          exclude: False

```
config_yml: |-
---
client:
hosts:
- elasticsearch-master
port: 9200
url_prefix:
use_ssl: True
certificate: '/certs/elastic-stack-ca.pem'
client_cert: '/certs/elastic-certificate.pem'
ssl_no_validate: True
http_auth: "XXXXX:XXXXXXXX"
timeout: 30
master_only: False
logging:
loglevel: DEBUG
logfile:
logformat: default
blacklist: ['elasticsearch', 'urllib3']

```

[untergeek]

This is not enough of the debug log to diagnose anything concretely. All I can tell is that in the end, Curator had filtered all indices.