Delete all indices with matching --timestring which are older than 30 daysedit

curator --host delete indices --older-than 30 --time-unit days \
   --timestring '%Y.%m.%d'


In previous versions of Curator, you would have needed as many runs of the command-line as you had prefixes, no matter the matching pattern. Not so any more! With this example, all indices with a pattern of %Y.%m.%d inside will be deleted. This is useful for managing both Logstash and Marvel indices with a single command, if you want the same retention period.


Kibana indices are omitted from deletion by default.

Alias a subset of indicesedit

curator --host alias --name lastmonth indices --newer-than 60 \
   --older-than 30 --timestring '%Y.%m.%d' --time-unit days --prefix logstash


In this example, logstash indices older than 30 days—but newer than 60—are added to alias lastmonth. Please note that Curator does not create aliases. It can only add to them or remove from them. Let’s take this example further, though.

curator --host alias --name lastmonth --remove indices --older-than 60 \
   --timestring '%Y.%m.%d' --time-unit days --prefix logstash
curator --host alias --name lastmonth indices --newer-than 60 \
   --older-than 30 --timestring '%Y.%m.%d' --time-unit days --prefix logstash


The updated, 2 line example now removes indices older than 60 days first, and then proceeds to make sure that everything between 30 and 60 days is in the alias. Note that Curator will not re-alias if the index is already in the alias.

Optimize only the specified indicesedit

curator --host optimize --max_num_segments 1 --delay 120 \
   --index indexname1 --index indexname2


This command will only operate on the named indices, indexname1 and indexname2. It will pause for 120 seconds after optimizing each index.

Show only indices with a timestringedit

curator --host show indices --timestring '%Y.%m.%d'


While timestring may nearly always be seen alongside --older-than, --newer-than, and --time-unit, there may be cases when you just want to act on indices with a timestamp in the name.

Close all indices, excepting those matching patterns do-not-touch and logstash-2015.03edit

curator --host close indices --exclude do-not-touch --exclude logstash-2015.03


In this case, all indices saving those matching pattern do-not-touch, or all Logstash indices for the month of March 2015 will be closed.