Q: Can Curator handle index names with strange characters?

edit

Q: Can Curator handle index names with strange characters?

edit

A: Yes!

edit

This problem can be resolved by using the --regex flag.

The Problem:

edit

Illegal characters make it hard to delete indices.

% curl logs.example.com:9200/_cat/indices
red    }?ebc-2015.04.08.03
                          sip-request{ 5 1         0  0     632b     316b
red    }?ebc-2015.04.08.03
                          sip-response 5 1         0  0     474b     237b
red    ?ebc-2015.04.08.02
                         sip-request{ 5 1         0  0     474b     316b
red
eb                               5 1         0  0     632b     316b
red    ?e                                5 1         0  0     632b     316b

You can see it looks like there are some tab characters and maybe newline characters. This makes it hard to use the HTTP API to delete the indices.

Dumping all the index settings out:

curl -XGET localhost:9200/*/_settings?pretty

…reveals the index names as the first key in the resulting JSON. In this case, the names were very atypical:

}\b?\u0011ebc-2015.04.08.02\u000Bsip-request{
}\u0006?\u0011ebc-2015.04.08.03\u000Bsip-request{
}\u0003?\u0011ebc-2015.04.08.03\fsip-response
...

Curator lets you use a regular expression to select indices to perform actions on.

To delete the first three from the above example, use .*sip.* as your regular expression:

curator delete indices --regex '.*sip.*'

Before attempting a delete, see what will be affected by using the show command first, or use the dry-run flag.

You may find that your regular expression matches an index you do not want deleted. In that event, use the --exclude flag to exclude one or more indices, by name or by pattern.

The next one is trickier. The real name of the index was \n\u0011eb. The regular expression .*b$ did not work, but \n.* did:

curator delete indices --regex '\n.*'

The last index can be deleted with a regular expression of .*e$:

curator delete indices --regex '.*e$'

« Q: Can I delete only certain data from within indices? Q: I’m getting DistributionNotFound and entry_point errors when I try to run Curator. What am I doing wrong? »