Installing Elasticsearch-Curator in Ubuntu 22.04 LTS

Introduction

Elasticsearch Curator oversees Elasticsearch time-arrangement records. It comprises of a Python library and a CLI instrument giving an elevated level interface to Elasticsearch organization assignments, for example, . – Management of record false names – Index advancement – Changing the copy check – Modifying the shard/file distribution utilizing steering labels – Index snapshotting . This bundle contains the guardian and es_repo_mgr order line apparatuses.

In this post, We will install elasticsearch curator on ubuntu 16.04, 18.04, 20.04 and 22.04 LTS

Step 1: Update System

You need to update the ubuntu repository by using the following commands.

sudo apt-get update

Step 2: Install PIP

To install elasticsearch curator, You need to install pip packages in your system bu using the following command.

sudo apt install python-pip

Step 3: Install Elasticsearch Curator

Just following the given command to install curator on ubuntu machine.

sudo pip install elasticsearch-curator

Step 4: Create config file of Curator

You need to create a file named curator.yml under the .curator directory, Use the following steps for that.

sudo mkdir /root/.curator

sudo vim /root/.curator/curator.yml

After this add the following elastic-search configuration like this, Remember, leave a key empty if there is no value. None will be a string.

client:
  hosts:
    - localhost
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: False
  http_auth: USER_NAME_HERE:PASSWORD_HERE
  timeout: 30
  master_only: False

logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

Save and exit from the editor.

Step 5: Add Metricbeat Indexes

Now you need to add the metricbeat index config file to auto delete when your cron job run, for that your need to create a metricbeat config file.

sudo vim /root/.curator/metricbeat.yml

and paste the following code in that file.

# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
#
# Also remember that all examples have 'disable_action' set to True.  If you
# want to use this action as a template, be sure to set this to False after
# copying it.
actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 25 days (based on index name), for logstash-
      prefixed indices. Ignore the error if the filter does not result in an


      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: metricbeat-
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 25
      exclude:

Save and exit from editor.

Step 6: Execute the Curator

Now you need to execute the curator to auto delete the old indexes you have been saved in metricbeat file.

sudo curator /root/.curator/metricbeat.yml

Conclusion

We have successfully created elastic search curator to clear the old database, Kindly report in case you are facing difficulties with following details.

• OS name
• OS version
• Package name
• Logs – Error / Warning / failed