diff --git a/system/elasticsearch/server/curator.yml b/system/elasticsearch/server/curator.yml
new file mode 100644
index 0000000..c0e9300
--- /dev/null
+++ b/system/elasticsearch/server/curator.yml
@@ -0,0 +1,87 @@
+parameters:
+  elasticsearch:
+    server:
+      curator:
+        timeout: 900
+        logfile: /var/log/elasticsearch/curator.log
+        logformat: json
+        actions:
+          - action: delete_indices
+            description: >-
+              Delete indices older than month (based on index name).
+              Ignore the error if the filter does not result in an actionable
+              list of indices (ignore_empty_list) and exit cleanly.
+            options:
+              ignore_empty_list: True
+              continue_if_exception: False
+              disable_action: False
+            filters:
+              - filtertype: pattern
+                kind: regex
+                value: 'netflow\-\d\d\d\d\.\d\d\.\d\d$'
+              - filtertype: age
+                source: name
+                direction: older
+                timestring: '%Y.%m.%d'
+                unit: days
+                unit_count: 30
+          - action: delete_indices
+            description: >-
+              Delete indices older than 6 months (based on index name).
+              Ignore the error if the filter does not result in an actionable
+              list of indices (ignore_empty_list) and exit cleanly.
+            options:
+              ignore_empty_list: True
+              continue_if_exception: False
+              disable_action: False
+            filters:
+              - filtertype: pattern
+                kind: regex
+                value: '.*\-\d\d\d\d\.\d\d\.\d\d$'
+              - filtertype: age
+                source: name
+                direction: older
+                timestring: '%Y.%m.%d'
+                unit: days
+                unit_count: 180
+          - action: replicas
+            description: >-
+              Reduce the replica count to 0 for indices older than 60 days
+              (based on index creation_date)
+            options:
+              count: 0
+              wait_for_completion: False
+              continue_if_exception: False
+              disable_action: False
+            filters:
+              - filtertype: pattern
+                kind: regex
+                value: '.*\-\d\d\d\d\.\d\d\.\d\d$'
+              - filtertype: age
+                source: creation_date
+                direction: older
+                unit: days
+                unit_count: 90
+          - action: forcemerge
+            description: >-
+              forceMerge indices older than 2 days (based on index
+              creation_date) to 2 segments per shard.  Delay 120 seconds
+              between each forceMerge operation to allow the cluster to
+              quiesce.
+              This action will ignore indices already forceMerged to the same
+              or fewer number of segments per shard, so the 'forcemerged'
+              filter is unneeded.
+            options:
+              max_num_segments: 2
+              delay: 120
+              continue_if_exception: False
+              disable_action: False
+            filters:
+              - filtertype: pattern
+                kind: regex
+                value: '.*\-\d\d\d\d\.\d\d\.\d\d$'
+              - filtertype: age
+                source: creation_date
+                direction: older
+                unit: days
+                unit_count: 2