From f134c74585e68aa6346a11452f6b635b931b92f7 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Mon, 21 Feb 2022 09:00:05 -0500 Subject: [PATCH 1/3] FIX: curator should exclude so-case* indices #7270 --- salt/curator/files/action/delete.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/salt/curator/files/action/delete.yml b/salt/curator/files/action/delete.yml index fb3945c1d..6e31b03b6 100644 --- a/salt/curator/files/action/delete.yml +++ b/salt/curator/files/action/delete.yml @@ -18,6 +18,10 @@ actions: - filtertype: pattern kind: regex value: '^(logstash-.*|so-.*)$' + - filtertype: pattern + kind: regex + value: '^(so-case.*)$' + exclude: True - filtertype: space source: creation_date use_age: True From bbced5b52fc7b25eabf0638434a448c2ca492bcf Mon Sep 17 00:00:00 2001 From: doug Date: Tue, 22 Feb 2022 17:00:52 -0500 Subject: [PATCH 2/3] FIX: curator should exclude so-case* indices #7270 --- .../files/bin/so-curator-closed-delete-delete | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/salt/curator/files/bin/so-curator-closed-delete-delete b/salt/curator/files/bin/so-curator-closed-delete-delete index eb38c73dc..b872a7aeb 100755 --- a/salt/curator/files/bin/so-curator-closed-delete-delete +++ b/salt/curator/files/bin/so-curator-closed-delete-delete @@ -34,9 +34,13 @@ overlimit() { closedindices() { - INDICES=$({{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed 2> /dev/null) + # If we can't query Elasticsearch, then immediately return false. + {{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed >/dev/null 2>&1 [ $? -eq 1 ] && return false - echo ${INDICES} | grep -q -E "(logstash-|so-)" + # First, get the list of closed indices using _cat/indices?h=index\&expand_wildcards=closed. + # Next, filter out any so-case indices. + # Finally, use grep's -q option to return true if there are any remaining logstash- or so- indices. + {{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed | grep -v "so-case" | grep -q -E "(logstash-|so-)" } # Check for 2 conditions: @@ -47,9 +51,10 @@ while overlimit && closedindices; do # We need to determine OLDEST_INDEX: # First, get the list of closed indices using _cat/indices?h=index\&expand_wildcards=closed. - # Then, sort by date by telling sort to use hyphen as delimiter and then sort on the third field. + # Next, filter out any so-case indices and only select the remaining logstash- or so- indices. + # Then, sort by date by telling sort to use hyphen as delimiter and sort on the third field. # Finally, select the first entry in that sorted list. - OLDEST_INDEX=$({{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed | grep -E "(logstash-|so-)" | sort -t- -k3 | head -1) + OLDEST_INDEX=$({{ ELASTICCURL }} -s -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/_cat/indices?h=index\&expand_wildcards=closed | grep -v "so-case" | grep -E "(logstash-|so-)" | sort -t- -k3 | head -1) # Now that we've determined OLDEST_INDEX, ask Elasticsearch to delete it. {{ ELASTICCURL }} -XDELETE -k https://{{ELASTICSEARCH_HOST}}:{{ELASTICSEARCH_PORT}}/${OLDEST_INDEX} From e93dbb53479a207196edd82bdca0b440cbf72d8c Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 1 Mar 2022 14:37:03 -0500 Subject: [PATCH 3/3] Update Hotfix --- HOTFIX | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/HOTFIX b/HOTFIX index aa8e22a9c..e2deb48db 100644 --- a/HOTFIX +++ b/HOTFIX @@ -1 +1 @@ -20220202 20220203 +20220202 20220203 20220301