Move closed indexes

[lukedevon]

Hi,

Suppose I have 1 month old closed indexes. I want to move those indexes to a remote storage. How can I identify and capture those closed indexes in command line ?

My backup retention period is : 90 days
Close indexes older than : 60 days ---> which means i have 30 days old closed indexes. Usually I am keeping only 60 days old indexes to be in active queries.
Delete indexes older than : 0 ---> I don't delete the indexes.

Thank you
Luke.

[mbellerue]

You can use the curator.sh script, which is an interface to the Elasticsearch curator command. Try this,

Code: Select all

/usr/local/nagioslogserver/scripts/curator.sh --host 127.0.0.1 show indecies --all-indecies

Edit:
Pro-tip: If you cut off the arguments in the "wrong" spot, curator will change its help output to match where you are in the command, which is super helpful when trying to build out a command like this.

[lukedevon]

Hi ,

This command displays all the indices.

/usr/local/nagioslogserver/scripts/curator.sh --host 127.0.0.1 show indices --all-indices

As I want to capture only closed-indices, I tried to execute the command as following;

/usr/local/nagioslogserver/scripts/curator.sh --host 127.0.0.1 show indices --closed-only

However I got following message; It seems I have entered incomplete command.

2020-02-10 16:01:51,788 ERROR At least one filter must be supplied.
Usage: curator show indices [OPTIONS]

Get a list of indices to act on from the provided arguments, then perform
the command [alias, allocation, bloom, close, delete, etc.] on the
resulting list.

Options:
--newer-than INTEGER Include only indices newer than n time_units
--older-than INTEGER Include only indices older than n time_units
--prefix TEXT Include only indices beginning with prefix.
--suffix TEXT Include only indices ending with suffix.
--time-unit [hours|days|weeks|months]
Unit of time to reckon by
--timestring TEXT Python strftime string to match your index
definition, e.g. 2014.07.15 would be
%Y.%m.%d
--regex TEXT Provide your own regex, e.g
'^prefix-.*-suffix$'
--exclude TEXT Exclude matching indices. Can be invoked
multiple times.
--index TEXT Include the provided index in the list. Can
be invoked multiple times.
--all-indices Do not filter indices. Act on all indices.
--closed-only Include only indices that are closed.
--help Show this message and exit.
ERROR. At least one filter must be supplied.

May I know what should be the command?

Thank you
Luke.

[Box293]

Code: Select all

/usr/local/nagioslogserver/scripts/curator.sh --host 127.0.0.1 show indices --closed-only --prefix logstash

This may take a few minutes to run with no screen output.