Curator not finding my index

Question

Trying to have curator clean up an index I have named "syslog"

I have this action yml:

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: syslog
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: hours
      unit_count: 1
      exclude:

I tried both "hours" and "days" but I keeping getting this message from curator:

 Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>

Answer 1

You are telling Curator that you want it to identify indices that have a prefix value of syslog, and also have a Year.Month.Day timestring in the index name. This would match, for example, if the index name were syslog-2017.03.14. But if the name of the index is only syslog, this filter set will not match.

Perhaps you want to catch the index age relative to when the index was created. In this case you'd set

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: regex
      value: '^syslog$'
    - filtertype: age
      source: creation_date
      direction: older
      unit: hours
      unit_count: 1

This will match only an index named syslog whose creation_date is at least one hour older than execution time.