elasticsearch - Elasticsearch Curator在按过滤器类型删除索引时不删除最后一个索引

Question

在Centos 7中使用Elasticsearch 5.1和Curator版本是4.3

我在elasticsearch中有一些索引，其命名格式为sample.data.YYYY_MM_DD，sample.file.YYYY_MM_DD
例如:-

sample.data.2019_07_22
sample.data.2019_07_23
sample.data.2019_07_25
sample.data.2019_07_26
sample.data.2019_07_28
sample.file.2019_07_21
sample.file.2019_07_25
sample.file.2019_07_26
sample.file.2019_07_29

我曾经在Linux中使用以下命令来运行操作文件。

策展人--config /root/config.yml /root/action_file.yml

我想删除所有索引，但最近创建的索引除外[sample.data.2019_07_28，sample.file.2019_07_29]

这是我尝试过的:-

  ---
  actions:
   1:
    action: delete_indices
    description: "Delete indices older than 3 days (based on index name), for workflow- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly."
    filters:
      - 
        exclude: ~
        filtertype: pattern
        kind: prefix
        value: sample.*.
      - 
        direction: older
        exclude: ~
        filtertype: age
        source: name
        timestring: "%Y%m%d"
        unit: days
        unit_count: 3
    options:
      continue_if_exception: false
      disable_action: false
      ignore_empty_list: true
      timeout_override: ~

即使我也使用了以下功能，它也会删除总索引，

- filtertype: count
  count: 4

预期输出如下:

sample.data.2019_07_28
sample.file.2019_07_29

Answer 1

我认为您应该将timestring从timestring: "%Y%m%d"更改为timestring: "%Y_%m_%d"。当我进行空转测试时，我得到:

2019-08-02 15:02:47,493 INFO      Preparing Action ID: 1, "delete_indices"
2019-08-02 15:02:47,513 INFO      Trying Action ID: 1, "delete_indices": Delete indices older than 3 days (based on index name), for workflow- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
2019-08-02 15:02:48,709 INFO      DRY-RUN MODE.  No changes will be made.
2019-08-02 15:02:48,709 INFO      (CLOSED) indices may be shown that may not be acted on by action "delete_indices".
2019-08-02 15:02:48,709 INFO      DRY-RUN: delete_indices: sample.file.2019_07_26 with arguments: {}
2019-08-02 15:02:48,709 INFO      DRY-RUN: delete_indices: sample.file.2019_07_27 with arguments: {}
2019-08-02 15:02:48,710 INFO      DRY-RUN: delete_indices: sample.file.2019_07_28 with arguments: {}
2019-08-02 15:02:48,710 INFO      DRY-RUN: delete_indices: sample.file.2019_07_29 with arguments: {}
2019-08-02 15:02:48,710 INFO      DRY-RUN: delete_indices: sample.file.2019_07_30 with arguments: {}
2019-08-02 15:02:48,710 INFO      Action ID: 1, "delete_indices" completed.
2019-08-02 15:02:48,710 INFO      Job completed.

希望能有所帮助。