initial commit
diff --git a/system/elasticsearch/server/curator.yml b/system/elasticsearch/server/curator.yml
new file mode 100644
index 0000000..c0e9300
--- /dev/null
+++ b/system/elasticsearch/server/curator.yml
@@ -0,0 +1,87 @@
+parameters:
+ elasticsearch:
+ server:
+ curator:
+ timeout: 900
+ logfile: /var/log/elasticsearch/curator.log
+ logformat: json
+ actions:
+ - action: delete_indices
+ description: >-
+ Delete indices older than month (based on index name).
+ Ignore the error if the filter does not result in an actionable
+ list of indices (ignore_empty_list) and exit cleanly.
+ options:
+ ignore_empty_list: True
+ continue_if_exception: False
+ disable_action: False
+ filters:
+ - filtertype: pattern
+ kind: regex
+ value: 'netflow\-\d\d\d\d\.\d\d\.\d\d$'
+ - filtertype: age
+ source: name
+ direction: older
+ timestring: '%Y.%m.%d'
+ unit: days
+ unit_count: 30
+ - action: delete_indices
+ description: >-
+ Delete indices older than 6 months (based on index name).
+ Ignore the error if the filter does not result in an actionable
+ list of indices (ignore_empty_list) and exit cleanly.
+ options:
+ ignore_empty_list: True
+ continue_if_exception: False
+ disable_action: False
+ filters:
+ - filtertype: pattern
+ kind: regex
+ value: '.*\-\d\d\d\d\.\d\d\.\d\d$'
+ - filtertype: age
+ source: name
+ direction: older
+ timestring: '%Y.%m.%d'
+ unit: days
+ unit_count: 180
+ - action: replicas
+ description: >-
+ Reduce the replica count to 0 for indices older than 60 days
+ (based on index creation_date)
+ options:
+ count: 0
+ wait_for_completion: False
+ continue_if_exception: False
+ disable_action: False
+ filters:
+ - filtertype: pattern
+ kind: regex
+ value: '.*\-\d\d\d\d\.\d\d\.\d\d$'
+ - filtertype: age
+ source: creation_date
+ direction: older
+ unit: days
+ unit_count: 90
+ - action: forcemerge
+ description: >-
+ forceMerge indices older than 2 days (based on index
+ creation_date) to 2 segments per shard. Delay 120 seconds
+ between each forceMerge operation to allow the cluster to
+ quiesce.
+ This action will ignore indices already forceMerged to the same
+ or fewer number of segments per shard, so the 'forcemerged'
+ filter is unneeded.
+ options:
+ max_num_segments: 2
+ delay: 120
+ continue_if_exception: False
+ disable_action: False
+ filters:
+ - filtertype: pattern
+ kind: regex
+ value: '.*\-\d\d\d\d\.\d\d\.\d\d$'
+ - filtertype: age
+ source: creation_date
+ direction: older
+ unit: days
+ unit_count: 2