diff --git a/HOTFIX b/HOTFIX index aa8e22a9c..e2deb48db 100644 --- a/HOTFIX +++ b/HOTFIX @@ -1 +1 @@ -20220202 20220203 +20220202 20220203 20220301 diff --git a/salt/curator/files/action/delete.yml b/salt/curator/files/action/delete.yml index fb3945c1d..6e31b03b6 100644 --- a/salt/curator/files/action/delete.yml +++ b/salt/curator/files/action/delete.yml @@ -18,6 +18,10 @@ actions: - filtertype: pattern kind: regex value: '^(logstash-.*|so-.*)$' + - filtertype: pattern + kind: regex + value: '^(so-case.*)$' + exclude: True - filtertype: space source: creation_date use_age: True diff --git a/salt/curator/files/bin/so-curator-closed-delete-delete b/salt/curator/files/bin/so-curator-closed-delete-delete index eb38c73dc..b872a7aeb 100755 --- a/salt/curator/files/bin/so-curator-closed-delete-delete +++ b/salt/curator/files/bin/so-curator-closed-delete-delete @@ -34,9 +34,13 @@ overlimit() { closedindices() { - INDICES=$({{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed 2> /dev/null) + # If we can't query Elasticsearch, then immediately return false. + {{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed >/dev/null 2>&1 [ $? -eq 1 ] && return false - echo ${INDICES} | grep -q -E "(logstash-|so-)" + # First, get the list of closed indices using _cat/indices?h=index\&expand_wildcards=closed. + # Next, filter out any so-case indices. + # Finally, use grep's -q option to return true if there are any remaining logstash- or so- indices. + {{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed | grep -v "so-case" | grep -q -E "(logstash-|so-)" } # Check for 2 conditions: @@ -47,9 +51,10 @@ while overlimit && closedindices; do # We need to determine OLDEST_INDEX: # First, get the list of closed indices using _cat/indices?h=index\&expand_wildcards=closed. - # Then, sort by date by telling sort to use hyphen as delimiter and then sort on the third field. + # Next, filter out any so-case indices and only select the remaining logstash- or so- indices. + # Then, sort by date by telling sort to use hyphen as delimiter and sort on the third field. # Finally, select the first entry in that sorted list. - OLDEST_INDEX=$({{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed | grep -E "(logstash-|so-)" | sort -t- -k3 | head -1) + OLDEST_INDEX=$({{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed | grep -v "so-case" | grep -E "(logstash-|so-)" | sort -t- -k3 | head -1) # Now that we've determined OLDEST_INDEX, ask Elasticsearch to delete it. {{ ELASTICCURL }} -XDELETE -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/${OLDEST_INDEX}