Rotation of indexe using Curator

Graylog Central (peer support)
7

Hi,

so, “allocation” is one type of actions Curator can do, it tells Curator to migrate your index from one node to another based on filters you define.

See my configuration as an example:

action: allocation
    description: "Apply shard allocation filtering rules to the hot log"
    options:
      key: box_type
      value: warm
      allocation_type: require
      wait_for_completion: True
      max_wait: 3600
      timeout_override:
      continue_if_exception: False
      disable_action: False
      allow_ilm_indices: True
    filters:
      - filtertype: pattern
        kind: prefix
        value: graylog_
      - filtertype: age
        source: creation_date
        direction: older
        unit: days
        unit_count: 1

A little of explaining, basically it will migrate indexes named like “graylog_” and older than 1 day from hot nodes to warm nodes.

Curator will know the nodes based on the key “box_type” with value “warm”.

You must tag your nodes using the option in the elasticsearch.yml file:

node.attr.box_type: hot # to hot nodes

And

node.attr.box_type: warm # to, you guess it, warm nodes

It strongly recomended that you take a moment to read the Curator’s doc to understand how to configure and run it.

1 Like