Curator: An Elastic Companion — Harry Suryapambagya

When I used curator to manage my old indices, I’ve got this error messages:

elk@elk /etc/elasticsearch/curator
# curator --config /etc/elasticsearch/curator/curator.yml /etc/elasticsearch/curator/action.yml

2021-06-23 22:38:56,041 INFO      Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>
2021-06-23 22:38:56,041 INFO      Action ID: 2, "delete_indices" completed.
2021-06-23 22:38:56,041 INFO      Preparing Action ID: 3, "delete_indices"
2021-06-23 22:38:56,041 INFO      Creating client object and testing connection
2021-06-23 22:38:56,041 INFO      Instantiating client object
2021-06-23 22:38:56,042 INFO      Testing client connectivity
2021-06-23 22:38:56,044 INFO      Successfully created Elasticsearch client object with provided settings
2021-06-23 22:38:56,047 INFO      Trying Action ID: 3, "delete_indices": Delete indices older than 3 days (based on index name), for filebeat- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
2021-06-23 22:38:56,617 ERROR     Unable to complete action "delete_indices".  No actionable items in list: <class 'curator.exceptions.NoIndices'>

error log when running curator action

After doing some GSGSCICILTT, I found this article:

https://github.com/elastic/curator/issues/1490#issuecomment-561467490

If you run Curator with loglevel set to DEBUG you will likely see an extra message that indicates that these logstash indices have an ILM (Index Lifecycle Management) policy affixed. Curator will not operate against indices with an ILM policy unless you set allow_ilm_indices: true.

For a brief explanation read this:

Set the options at your curator directory on file action.yml

After edit and reload the services, I tried to run curator again.

elk@elk /etc/elasticsearch/curator
# curator --config /etc/elasticsearch/curator/curator.yml /etc/elasticsearch/curator/action.yml

2021-06-23 22:40:15,917 INFO      Deleting 16 selected indices: ['elastiflow-4.0.1-2021.06.13', 'elastiflow-4.0.1-2021.06.07', 'elastiflow-4.0.1-2021.06.01', 'elastiflow-4.0.1-2021.06.09', 'elastiflow-4.0.1-2021.06.04', 'elastiflow-4.0.1-2021.06.10', 'elastiflow-4.0.1-2021.05.29', 'elastiflow-4.0.1-2021.06.02', 'elastiflow-4.0.1-2021.05.31', 'elastiflow-4.0.1-2021.06.05', 'elastiflow-4.0.1-2021.06.11', 'elastiflow-4.0.1-2021.06.03', 'elastiflow-4.0.1-2021.05.27', 'elastiflow-4.0.1-2021.05.30', 'elastiflow-4.0.1-2021.05.28', 'elastiflow-4.0.1-2021.06.12']
2021-06-23 22:40:15,917 INFO      ---deleting index elastiflow-4.0.1-2021.06.13
2021-06-23 22:40:15,917 INFO      ---deleting index elastiflow-4.0.1-2021.06.07
2021-06-23 22:40:15,917 INFO      ---deleting index elastiflow-4.0.1-2021.06.01
2021-06-23 22:40:15,917 INFO      ---deleting index elastiflow-4.0.1-2021.06.09
2021-06-23 22:40:15,917 INFO      ---deleting index elastiflow-4.0.1-2021.06.04
2021-06-23 22:40:15,917 INFO      ---deleting index elastiflow-4.0.1-2021.06.10
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.05.29
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.06.02
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.05.31
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.06.05
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.06.11
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.06.03
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.05.27
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.05.30
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.05.28
2021-06-23 22:40:15,918 INFO      ---deleting index elastiflow-4.0.1-2021.06.12
2021-06-23 22:40:17,606 INFO      Action ID: 3, "delete_indices" completed.
2021-06-23 22:40:17,606 INFO      Job completed.

And it’s works! Thanks to untergeek.