csirtgadgets/massive-octo-spice

Not able to delete old data from database

priyamalik opened this issue · 1 comments

I was following below link for pruning.
https://github.com/csirtgadgets/massive-octo-spice/wiki/Pruning-the-ElasticSearch-database

(1) apt-get -y install python-pip
output>> it was already installed.

(2) sudo pip install elasticsearch-curator
Output>>
Requirement already satisfied (use --upgrade to upgrade): elasticsearch-curator in /usr/local/lib/python2.7/dist-packages
Requirement already satisfied (use --upgrade to upgrade): elasticsearch<3.0.0,>=2.4.0 in /usr/local/lib/python2.7/dist-packages (from elasticsearch-curator)
Requirement already satisfied (use --upgrade to upgrade): click>=6.0 in /usr/local/lib/python2.7/dist-packages (from elasticsearch-curator)
Requirement already satisfied (use --upgrade to upgrade): pyyaml>=3.10 in /usr/local/lib/python2.7/dist-packages (from elasticsearch-curator)
Requirement already satisfied (use --upgrade to upgrade): voluptuous>=0.9.3 in /usr/local/lib/python2.7/dist-packages (from elasticsearch-curator)
Requirement already satisfied (use --upgrade to upgrade): certifi>=2016.09.26 in /usr/local/lib/python2.7/dist-packages (from elasticsearch-curator)
Requirement already satisfied (use --upgrade to upgrade): setuptools>=0.6b1 in /usr/local/lib/python2.7/dist-packages (from voluptuous>=0.9.3->elasticsearch-curator)
Cleaning up...

(3) /usr/local/bin/curator --host localhost --master-only delete indices --prefix cif.observables --older-than 3 --time-unit days --timestring '%Y.%m.%d'
output>>Error: no such option: --host

Please help.

Thanks and Regards,
Priya

you need to match up elastic curator with the correct version of elasticsearch (1.4). newer versions of elastic curator will not work with older versions of elastic search.