mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-10-26 10:14:45 +00:00
27 lines
840 B
YAML
27 lines
840 B
YAML
|
# Remember, leave a key empty if there is no value. None will be a string,
|
||
|
|
# not a Python "NoneType"
|
||
|
|
#
|
||
|
|
# Also remember that all examples have 'disable_action' set to True. If you
|
||
|
|
# want to use this action as a template, be sure to set this to False after
|
||
|
|
# copying it.
|
||
|
|
actions:
|
||
|
|
1:
|
||
|
|
action: delete_indices
|
||
|
|
description: >-
|
||
|
|
Delete indices older than 90 days (based on index name), for logstash-
|
||
|
|
prefixed indices. Ignore the error if the filter does not result in an
|
||
|
|
actionable list of indices (ignore_empty_list) and exit cleanly.
|
||
|
|
options:
|
||
|
|
ignore_empty_list: True
|
||
|
|
disable_action: False
|
||
|
|
filters:
|
||
|
|
- filtertype: pattern
|
||
|
|
kind: prefix
|
||
|
|
value: logstash-
|
||
|
|
- filtertype: age
|
||
|
|
source: name
|
||
|
|
direction: older
|
||
|
|
timestring: '%Y.%m.%d'
|
||
|
|
unit: days
|
||
|
|
unit_count: 90
|