Question

尝试让策展人清理我已经命名为＆＃34; syslog＆＃34;

的索引

我有这个动作yml：

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: syslog
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: hours
      unit_count: 1
      exclude:

我试过了两个小时＆＃34;小时＆＃34;和＆＃34;天＆＃34;但是我一直从策展人那里得到这个消息：

 Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>

Answer 1

您告诉Curator您希望它识别前缀值为syslog的索引，并且索引名称中还包含Year.Month.Day时间字符串。例如，如果索引名称为syslog-2017.03.14，则会匹配。但是，如果索引的名称仅为syslog，则此过滤器集将不匹配。

也许您希望捕获相对于创建索引时的索引年龄。在这种情况下，你要设置

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: regex
      value: '^syslog$'
    - filtertype: age
      source: creation_date
      direction: older
      unit: hours
      unit_count: 1

这将仅匹配名为syslog的索引，其creation_date比执行时间至少早一个小时。

策展人找不到我的索引

1 个答案: