elastic / elastic/curator

Dangerous behaviour of timestring

Open
#1,271 8 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
3.1k
Forks
627
PR merge metrics
No merged PRs in 30d

Description

According to docs the timestring finds pattern anywhere in the index name. Nowadays it is best practice for log management indexes to include beats version in index names. We also include our doc version in index name and use not only beats as agents. So index names can be:
- index-myversion-50-filebeat-6.3.0-2018.05
- index-myversion-10-customagent-12.5-2018.05

and easily become:
- index-myversion-10-customagent-2019.11-2018.05

As it is more and more favourite to do big number steps (or use year versioning) in app versions.

I propose to add config option to allow timestring position. In most cases the date will be the last part of index name so by default it could also be fixed to "DATE$" pattern.

I think it is a matter of time this behaviour will cause a big troubles.

Contributor guide

Open the contributing guide

Research direction

Start with the timestring documentation and the existing behavior for matching dates in index names. Compare that behavior with the supplied versioned index examples; done means a configurable position prevents version numbers from being interpreted as dates and the expected behavior is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
elasticsearch, python
Domain
databases
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.