策展人找不到我的索引

Question

试图让策展人清理一个名为“syslog”的索引

我有这个动作yml：

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: syslog
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: hours
      unit_count: 1
      exclude:

我尝试了“小时”和“天”，但我不断从策展人那里收到这条消息：

 Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>

Answer 1

您告诉Curator您希望它识别前缀值为syslog的索引，并且索引名称中也包含Year.Month.Day时间字符串。例如，如果索引名称为syslog-2017.03.14，则匹配。但如果索引的名称只是syslog，则此过滤器集将不匹配。

也许您希望捕获相对于创建索引时的索引年龄。在这种情况下，你设置

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: regex
      value: '^syslog$'
    - filtertype: age
      source: creation_date
      direction: older
      unit: hours
      unit_count: 1

这将仅匹配名为syslog的索引，其creation_date比执行时间至少早一个小时。